CVE-2026-76475 tracks several cross-site scripting (CWE-79) vulnerabilities that Cisco found in its own review of its unified communications and voice products, with a CVSS 3.1 score of 9.3 (Critical).
What Is It
CVE-2026-76475 groups several web input-handling flaws that Cisco's engineering teams found in a comprehensive internal security review. They fall under CWE-79: Improper Neutralization of Input During Web Page Generation, also known as cross-site scripting. Cisco fixed them in software hardening releases rather than in a standalone fix for this one CVE.
Cisco PSIRT published the record to NVD on 2026-10-21. NVD lists its status as "Awaiting Analysis."
Why It Matters
Cisco PSIRT rates this 9.3 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N:
- Network attack vector, low complexity: it can be reached remotely and is not hard to exploit.
- No privileges required: the attacker does not need to log in.
- User interaction required: a user has to take an action, such as opening a crafted link or page.
- Scope changed: the impact reaches beyond the vulnerable component.
- High confidentiality and integrity impact, no availability impact.
These products often run core enterprise telephony, presence, voicemail, and emergency calling.
Exploitation status: The sources cited below do not mention any public exploitation. They also say nothing about whether the CVE is in the CISA Known Exploited Vulnerabilities (KEV) catalog. Check the KEV catalog directly for its current status.
What's Vulnerable
Cisco lists affected versions for these products:
- Cisco Emergency Responder: 14 through 14SU6 (including 14SU3a) and 15 through 15SU4 (including 15SU1a)
- Cisco Unified Communications Manager: 14 through 14SU6 (including 14SU4a), 15 through 15SU4a (including 15SU1a and 15SU3a), and builds 15.0.1.13010-1 through 15.0.1.13017-1
- Cisco Unified CM IM & Presence Service: 14 through 14SU6 (including 14SU2a) and 15 through 15SU4
- Cisco Unity Connection: 14 through 14SU6 (including 14SU3a) and 15 through 15SU4
The review also covered Cisco Prime Collaboration Deployment and Unified CM Session Management Edition. The affected-version data does not list specific versions for either one.
Patch Status
Cisco says the problems are fixed in software hardening releases from this review. The supplied data does not name the fixed versions. Administrators should:
- Check the Cisco security advisory below for the fixed release for each product and version train.
- Upgrade affected deployments.
- Check the CISA KEV catalog for any required action or due date.