Zero Radar
← feed
CriticalVulnerabilityCVE-2026-76474updated 27 Oct 2026, 14:49 UTC

Cisco Unified Communications products: critical authentication bypass flaw, attacks confirmed

Attackers may be able to get past the login checks on Cisco phone and calling servers without valid credentials. Cisco confirms this is being exploited, so treat these servers as at risk.

Exploited (Cisco PSIRT)Fix availableOfficial, 2 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?YesConfirmed by Cisco PSIRT · 27 Oct 2026
Fix available?YesSoftware updates in the Cisco Unified Communications October 2026 Security Hardening Release (specific fixed versions not stated in the provided material; see Cisco advisory). · since 25 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker targets serverReaches the exposed Cisco voice service
  2. 2Login check bypassedImproper authentication lets them skip verification
  3. 3Admin access gainedAttacker acts as a trusted user
  4. 4Calling system controlledSettings, calls, and users can be changed
  5. ResultAttacker controls the voice system

What happened

Improper authentication flaws (CWE-287) in Cisco Emergency Responder, Prime Collaboration Deployment, Unified Communications Manager (Unified CM), Unified CM IM&P, Unified CM SME, and Unity Connection, grouped under CVE-2026-76474 and rated critical (CVSS 9.8).

Why it is dangerous: A successful attacker could gain unauthorized access to core voice and calling infrastructure, which can disrupt phone service and expose communications. Organizations running these Cisco voice platforms are at risk.

Are you affected?

You are affected if you run Cisco Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, or Unity Connection on a version without the October 2026 hardening release.

Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager, Cisco Unified CM IM&P, Cisco Unified CM Session Management Edition, Cisco Unity Connection (specific versions not stated in the provided material; see Cisco advisory cisco-sa-voice-hardening-twgbH9e3).

What to do

  1. Check your Cisco voice product versions against the Cisco advisory cisco-sa-voice-hardening-twgbH9e3
  2. Install the October 2026 Cisco Unified Communications hardening release on all affected servers
  3. Restrict access to administration interfaces to trusted networks while patching
  4. Review authentication logs for unexpected or unauthorized logins

Timeline

  1. 21 Oct 2026, 17:19 UTC
    Publicly disclosed
  2. 21 Oct 2026, 17:19 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 14:49 UTC
    Cisco PSIRT reported on it · Cisco PSIRT
  4. 27 Oct 2026, 14:49 UTC
    Confirmed by Cisco PSIRT

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-76474
CVSS
9.8 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
21 Oct 2026, 17:19 UTC
On Zero Radar
before the radar started
Last change
27 Oct 2026, 14:49 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Cisco Unified Communications products: critical authentication bypass flaw, attacks confirmed · Zero Radar