Cisco has disclosed CVE-2026-76474, a critical (CVSS 9.8) improper authentication issue that its own internal review found across several Unified Communications and collaboration products. Cisco has addressed it in software hardening releases.
What Is It
CVE-2026-76474 covers multiple vulnerabilities that Cisco engineering teams found during a comprehensive internal security review of their voice and collaboration portfolio. Cisco groups these issues under CWE-287 (Improper Authentication). The NVD record does not describe the individual flaws or how they would be exploited. As of publication on 2026-10-21, NVD lists the record as "Awaiting Analysis."
Why It Matters
Cisco rates the issue 9.8 (CRITICAL), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That vector means:
- The flaws can be reached over the network.
- Attack complexity is low.
- No privileges or user interaction are needed.
- Confidentiality, integrity and availability impact are all high.
These products typically handle an organization's call control, voicemail, presence and emergency call routing. An authentication bypass in these systems could have serious operational consequences.
Cisco describes the vulnerabilities as internally discovered.
What's Vulnerable
Cisco's advisory names six products: Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME and Unity Connection. The structured affected data lists versions for four of them:
- Cisco Emergency Responder: 14 through 14SU6, and 15 through 15SU4 (including 14SU3a and 15SU1a)
- Cisco Unified Communications Manager: 14 through 14SU6, and 15 through 15SU4a (including 14SU4a, 15SU1a, 15SU3a and builds 15.0.1.13010-1 through 15.0.1.13017-1)
- Cisco Unified Communications Manager IM and Presence Service: 14 through 14SU6 (including 14SU2a), and 15 through 15SU4
- Cisco Unity Connection: 14 through 14SU6 (including 14SU3a), and 15 through 15SU4
The NVD data does not list specific affected versions for Prime Collaboration Deployment or Unified CM SME.
Patch Status
Cisco says it has released software hardening releases that fix the vulnerabilities. The supplied data does not name fixed version numbers. Administrators should check the Cisco advisory for the fixed releases for each product and upgrade affected deployments.