Zero Radar
← feed
CriticalVulnerabilityCVE-2026-76473updated 27 Oct 2026, 14:49 UTC

Cisco Unified Communications products have a critical flaw in resource handling

Attackers may be able to take control of Cisco phone and voice servers without logging in. Cisco has confirmed the flaw is being exploited, so patching quickly matters.

Exploited (Cisco PSIRT)Fix availableOfficial, 2 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?YesConfirmed by Cisco PSIRT · 27 Oct 2026
Fix available?YesSoftware updates in the October 2026 Cisco Unified Communications hardening release (see Cisco advisory cisco-sa-voice-hardening-twgbH9e3). Exact fixed version numbers: unknown from the provided material. · since 25 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

What happened

A group of internally found flaws in Cisco Unified Communications products is grouped under CWE-74 (improper control of a resource through its lifetime). The advisory does not state the exact technical mechanism for CVE-2026-76473.

Why it is dangerous: Successful exploitation could seriously compromise voice and communications servers that many organizations rely on for calls and messaging. Exploitation has been confirmed by Cisco PSIRT.

Are you affected?

You are affected if you run Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified CM, Cisco Unified CM IM&P, Cisco Unified CM SME, or Cisco Unity Connection with a version older than the October 2026 hardening release.

Cisco Emergency Responder; Cisco Prime Collaboration Deployment; Cisco Unified Communications Manager (Unified CM); Cisco Unified CM IM & Presence Service; Cisco Unified CM Session Management Edition; Cisco Unity Connection. Specific version ranges: unknown from the provided material.

What to do

  1. Identify all Cisco Unified Communications servers listed as affected in your environment
  2. Install the October 2026 Cisco Unified Communications hardening release from Cisco's advisory cisco-sa-voice-hardening-twgbH9e3
  3. Check the advisory for the exact fixed version for each product you run
  4. Review the advisory for the related CVEs (CVE-2026-76474 through CVE-2026-76481) and patch them together

Timeline

  1. 21 Oct 2026, 17:19 UTC
    Publicly disclosed
  2. 21 Oct 2026, 17:19 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 14:49 UTC
    Cisco PSIRT reported on it · Cisco PSIRT
  4. 27 Oct 2026, 14:49 UTC
    Confirmed by Cisco PSIRT

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-76473
CVSS
9.8 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
21 Oct 2026, 17:19 UTC
On Zero Radar
before the radar started
Last change
27 Oct 2026, 14:49 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Cisco Unified Communications products have a critical flaw in resource handling · Zero Radar