Act nowDisclosed

Advisory · CVE-2026-76473

Cisco Unified Communications hardening grouping for improper code generation control is rated 9.8

Cisco grouped issues concerning improper control of generation of code under CVE-2026-76473 in an October 2026 hardening release for Cisco Unified Communications products including Unified CM, Unified CM IM and Presence, Unity Connection and Emergency Responder, with software updates released and no workarounds. CVSS 3.1 9.8.

Advisory published October 21, 2026Independent summary
Vendor
Cisco
Product
Cisco Unified Communications Manager
Identifier / CWE
CVE-2026-76473
CWE-74
Action timing
Immediate
ELI5

Explain it like I’m five

Cisco found a set of code generation control flaws across its phone system products and grouped them under one CVE. The fix is the hardening software update Cisco released, because there is no workaround.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Attacker reaches a Unified Communications product

    A network attacker reaches an affected Cisco Unified Communications deployment.

  2. 02Grouped code generation flaw is triggered

    Per the Cisco grouping for this CVE, the affected issues concern improper control of generation of code, tracked under CWE-74.

  3. 03Full impact per Cisco scoring

    Cisco scores this grouping at CVSS 3.1 9.8 with network attack vector, low complexity, no privileges, no user interaction, and high confidentiality, integrity and availability impact.

What happened

Cisco disclosed CVE-2026-76473 as part of the Cisco Unified Communications Products Security Hardening Release for October 2026. Cisco states that engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM and Presence Service, Cisco Unified Communications Manager Session Management Edition and Cisco Unity Connection conducted an internal security review that resulted in hardening releases addressing multiple internally discovered vulnerabilities. Cisco grouped the issues tracked by this CVE by vulnerability class and states they were found during internal testing and are not known to be actively exploited. The issues in this grouping concern improper control of a resource through its lifetime as described in the NVD record and are grouped under CWE-74. The CVSS 3.1 score is 9.8.

The NVD record lists affected releases across the 14 and 15 product lines for Emergency Responder, Unified CM, Unified CM IM and Presence Service and Unity Connection. Cisco states it has released software updates that address these vulnerabilities and that there are no workarounds. No specific fixed version is claimed here beyond that vendor statement, so confirm the fixed release for your train in the Cisco advisory and its linked release guidance before scheduling the upgrade.

What to do

  1. Inventory Cisco Unified Communications deployments, including Unified CM, Unified CM IM and Presence, Unified CM Session Management Edition, Unity Connection, Emergency Responder and Prime Collaboration Deployment, and note the release of each.
  2. Apply the Cisco software updates that address this hardening release for your train, following the Cisco advisory; there are no workarounds.
  3. Restrict network access to Unified Communications administration and services to management networks while remediation is underway.
  4. Hunt for unexpected administrative actions, configuration changes, and service restarts on Unified Communications systems before the update.
  5. Verify the deployed release after updating on every node in each cluster, including subscribers and standby systems.

Management note

Unified Communications is core enterprise voice infrastructure, and Cisco rated this grouping at the top of the scale with no workaround. Schedule the Cisco hardening update for every cluster node and do not leave subscribers or standby systems on the old release.