Act nowDisclosed

Advisory · CVE-2026-76475

Cisco Unified Communications hardening grouping for cross-site scripting is rated 9.3 with changed scope

Cisco grouped improper neutralization of input during web page generation issues under CVE-2026-76475 in an October 2026 hardening release for Cisco Unified Communications products including Unified CM, Unified CM IM and Presence, Unity Connection and Emergency Responder, with software updates released and no workarounds. CVSS 3.1 9.3.

Advisory published October 21, 2026Independent summary
Vendor
Cisco
Product
Cisco Unified Communications Manager
Identifier / CWE
CVE-2026-76475
CWE-79
Action timing
Immediate
ELI5

Explain it like I’m five

Cisco found a set of web page input handling flaws across its phone system products and grouped them under one CVE. A crafted interaction can run attacker content in a user session on the affected web interface, so the fix is the hardening update Cisco released.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Attacker prepares crafted input

    A network attacker prepares input aimed at a web interface of an affected Cisco Unified Communications product.

  2. 02Victim interacts with the affected page

    Per Cisco scoring for this grouping, user interaction is required, so a user must interact with the affected web content.

  3. 03Input is not properly neutralized

    Per the Cisco grouping for this CVE, the affected issues concern improper neutralization of input during web page generation, tracked under CWE-79.

  4. 04Impact in a changed scope

    Cisco scores this grouping at CVSS 3.1 9.3 with changed scope and high confidentiality and integrity impact, and no privileges required.

What happened

Cisco disclosed CVE-2026-76475 as part of the Cisco Unified Communications Products Security Hardening Release for October 2026. Cisco states that engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM and Presence Service, Cisco Unified Communications Manager Session Management Edition and Cisco Unity Connection conducted an internal security review that resulted in hardening releases addressing multiple internally discovered vulnerabilities. Cisco grouped the issues tracked by this CVE by vulnerability class and states they were found during internal testing and are not known to be actively exploited. The issues in this grouping concern improper neutralization of input during web page generation (CWE-79). The CVSS 3.1 score is 9.3, with network attack vector, low complexity, no privileges, user interaction required, and changed scope.

The NVD record lists affected releases across the 14 and 15 product lines for Emergency Responder, Unified CM, Unified CM IM and Presence Service and Unity Connection. Cisco states it has released software updates that address these vulnerabilities and that there are no workarounds. No specific fixed version is claimed here beyond that vendor statement, so confirm the fixed release for your train in the Cisco advisory and its linked release guidance before scheduling the upgrade.

What to do

  1. Inventory Cisco Unified Communications deployments, including Unified CM, Unified CM IM and Presence, Unified CM Session Management Edition, Unity Connection, Emergency Responder and Prime Collaboration Deployment, and note the release of each.
  2. Apply the Cisco software updates that address this hardening release for your train, following the Cisco advisory; there are no workarounds.
  3. Restrict access to Unified Communications web interfaces to management networks and expected administrator workstations while remediation is underway.
  4. Remind administrators not to follow unexpected links into Unified Communications interfaces, and hunt for administrator sessions or configuration changes that follow unusual web requests.
  5. Verify the deployed release after updating on every node in each cluster, including subscribers and standby systems.

Management note

A changed-scope scripting grouping on the admin web interface puts administrator sessions at risk, which is how a voice platform gets reconfigured by someone else. Patch it with the rest of the October hardening release and keep the web interfaces on management networks only.