Act nowDisclosed

Advisory · CVE-2026-76474

Cisco Unified Communications hardening grouping for improper authentication is rated 9.8

Cisco grouped improper authentication issues under CVE-2026-76474 in an October 2026 hardening release for Cisco Unified Communications products including Unified CM, Unified CM IM and Presence, Unity Connection and Emergency Responder, with software updates released and no workarounds. CVSS 3.1 9.8.

Advisory published October 21, 2026Independent summary
Vendor
Cisco
Product
Cisco Unified Communications Manager
Identifier / CWE
CVE-2026-76474
CWE-287
Action timing
Immediate
ELI5

Explain it like I’m five

Cisco found a set of authentication flaws across its phone system products and grouped them under one CVE. If authentication can be bypassed on a voice platform, the fix is the hardening update Cisco released, because there is no workaround.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Attacker reaches a Unified Communications product

    A network attacker reaches an affected Cisco Unified Communications deployment.

  2. 02Grouped authentication flaw is triggered

    Per the Cisco grouping for this CVE, the affected issues concern improper authentication, tracked under CWE-287.

  3. 03Full impact per Cisco scoring

    Cisco scores this grouping at CVSS 3.1 9.8 with network attack vector, low complexity, no privileges, no user interaction, and high confidentiality, integrity and availability impact.

What happened

Cisco disclosed CVE-2026-76474 as part of the Cisco Unified Communications Products Security Hardening Release for October 2026. Cisco states that engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM and Presence Service, Cisco Unified Communications Manager Session Management Edition and Cisco Unity Connection conducted an internal security review that resulted in hardening releases addressing multiple internally discovered vulnerabilities. Cisco grouped the issues tracked by this CVE by vulnerability class and states they were found during internal testing and are not known to be actively exploited. The issues in this grouping concern improper authentication (CWE-287). The CVSS 3.1 score is 9.8.

The NVD record lists affected releases across the 14 and 15 product lines for Emergency Responder, Unified CM, Unified CM IM and Presence Service and Unity Connection. Cisco states it has released software updates that address these vulnerabilities and that there are no workarounds. No specific fixed version is claimed here beyond that vendor statement, so confirm the fixed release for your train in the Cisco advisory and its linked release guidance before scheduling the upgrade.

What to do

  1. Inventory Cisco Unified Communications deployments, including Unified CM, Unified CM IM and Presence, Unified CM Session Management Edition, Unity Connection, Emergency Responder and Prime Collaboration Deployment, and note the release of each.
  2. Apply the Cisco software updates that address this hardening release for your train, following the Cisco advisory; there are no workarounds.
  3. Restrict network access to Unified Communications administration and services to management networks while remediation is underway, and review which systems can reach them.
  4. Hunt for logins or sessions that do not match expected authentication patterns, unexpected administrator accounts, and configuration changes on Unified Communications systems before the update.
  5. Verify the deployed release after updating on every node in each cluster, including subscribers and standby systems.

Management note

An authentication grouping at 9.8 on the voice platform is a platform trust issue, not a routine patch. Apply the Cisco hardening update across every cluster and review authentication logs for the period before it landed.