Cisco has published CVE-2026-76473, rated CVSS 9.8 (Critical), for several vulnerabilities in its unified communications and voice products. According to Cisco, its own engineers found these flaws during an internal security review, and the company says software hardening releases address them. Cisco has not yet listed specific fixed versions in the available data.
What Is It
CVE-2026-76473 covers several vulnerabilities that, according to Cisco, its engineering teams found during a comprehensive internal security review. Cisco describes them as "issues concerning improper control of a resource through its lifetime." That wording matches the broad CWE-664 class (Improper Control of a Resource Through its Lifetime). The CVE record, however, assigns CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, or "Injection"). The available data does not explain why the two differ. Until NVD finishes its analysis or Cisco clarifies, the exact weakness type is unconfirmed. The products covered by the review are Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Unified Communications Manager (Unified CM), Unified CM IM & Presence Service, Unified CM Session Management Edition, and Cisco Unity Connection.
The NVD record was published on 2026-10-21 and is still marked "Awaiting Analysis."
Why It Matters
Cisco scores this CVE at 9.8 Critical with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This is Cisco's own score and NVD has not yet reviewed it. Cisco has not released technical details, so the vector describes the worst case Cisco assessed, not a confirmed attack path. According to the vector:
- Network attack vector, low complexity (AV:N/AC:L): Cisco rates the flaws as reachable over the network, with no special conditions needed to exploit them.
- No privileges or user interaction required (PR:N/UI:N): Cisco's rating means an attacker would not need an account or any action from a user.
- High impact on confidentiality, integrity, and availability (C:H/I:H/A:H): Cisco rates a successful attack as potentially affecting all three.
These products run enterprise voice, voicemail, presence, and emergency call routing, which makes them high-value systems.
As of this writing, CVE-2026-76473 does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. Active exploitation is therefore not confirmed at this time.
What's Vulnerable
According to Cisco PSIRT's affected-product data:
- Cisco Emergency Responder: 14 through 14SU6 (including 14SU3a) and 15 through 15SU4 (including 15SU1a)
- Cisco Unified Communications Manager: 14 through 14SU6 (including 14SU4a); 15 through 15SU4a (including 15SU1a and 15SU3a); and builds 15.0.1.13010-1 through 15.0.1.13017-1
- Cisco Unified CM IM and Presence Service: 14 through 14SU6 (including 14SU2a) and 15 through 15SU4
- Cisco Unity Connection: 14 through 14SU6 (including 14SU3a) and 15 through 15SU4
The description names Cisco Prime Collaboration Deployment and Unified CM SME, but the NVD record has no version-level affected data for either product.
Patch Status
Cisco says the internal review "resulted in software hardening releases" that address these vulnerabilities. The available data does not list specific fixed versions, so it does not independently confirm which releases remediate the issues. Administrators should check the Cisco advisory below for fixed releases and upgrade guidance for each product. Because the CVE is not in the CISA KEV catalog, there is no CISA remediation deadline under Binding Operational Directive 22-01.
Sources
- Cisco Security Advisory: cisco-sa-voice-hardening-twgbH9e3
- NVD: CVE-2026-76473
- CISA Known Exploited Vulnerabilities Catalog
- MITRE CWE-664: Improper Control of a Resource Through its Lifetime
- MITRE CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')