Medium [CVE-2026-76487] Cisco Unified Communications Manager Improper Access Control Vulnerability
This medium-severity Cisco advisory covers CVE-2026-76487 affecting Unified Communications Manager.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Get an email when Cisco publishes the next one.
VulniPulse checks Cisco's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.
Summary
A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct access control bypass attacks on an affected device.
This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device.
A successful exploit could allow the attacker to access parts of the network that are beyond the scope of their intended access.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is part of a group of advisories. For a complete list of the advisories and links to them, see Cisco Advance Notification for Publication of October 21, 2026, Security Advisories.
In addition, for further documentation of improvements and fixes in Cisco Unified CM, see Cisco Unified Communications Products Security Hardening Release: October 2026.
- Scope: At the time of publication, this vulnerability affected Cisco Unified CM and Unified CM SME, regardless of device configuration.
- 14 — Migrate to a fixed release
- Release 15 (first fixed: 15SU5)
Official advisory · high-confidence parse· fetched 3 days ago·verify at source
Mitigation checklist
- Upgrade to the first fixed release for your train per the Fixed Releases table in this advisory.
- Release 14: migrate to a fixed release.
- Release 15: upgrade to 15SU5.
- There are no workarounds that address this vulnerability.
Official advisory · high-confidence parse· fetched 3 days ago·verify at source
More Cisco advisories
- CVE-2026-76418Oct 28, 2026Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense
- cisco-sa-notice-I8z3n6lKOct 28, 2026Cisco Advance Notification for Publication of November 4, 2026, Security Advisories
- CVE-2026-105482Oct 27, 2026Vulnerabilities in Node.js Affecting Cisco Products: October 2026
- cisco-sa-emudhra-info-ScS22A1rOct 23, 2026Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate
- CVE-2026-109618Oct 21, 2026Vulnerabilities in PHP Affecting Cisco Products: October 2026
- CVE-2026-76445Oct 21, 2026Multiple Cisco Products Snort 3 Denial of Service Vulnerability
Android app · Google Play
Monitor future Cisco CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.