Zero Radar
← feed
CriticalVulnerabilityCVE-2026-76475updated 27 Oct 2026, 14:49 UTC

Cisco Unified Communications products: cross-site scripting flaw (critical)

Attackers may be able to inject malicious code into web pages used to manage Cisco phone and calling systems. A user who opens a crafted link could have their session or actions hijacked.

Exploited (Cisco PSIRT)Fix availableOfficial, 2 sources
SeverityCriticalCVSS 9.3 of 10
Being exploited?YesConfirmed by Cisco PSIRT · 27 Oct 2026
Fix available?YesSoftware updates in the Cisco Unified Communications Products Security Hardening Release, October 2026. Specific fixed versions: unknown from this material. · since 25 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Crafted inputAttacker submits malicious script in a field
  2. 2Page rendered unsafelyInput is not neutralized in the web page
  3. 3Admin opens pageVictim's browser runs the injected script
  4. 4Session hijackedScript steals session or performs actions
  5. ResultAttacker controls the admin's session

What happened

Input is not properly neutralized during web page generation in several Cisco Unified Communications products (CWE-79, cross-site scripting), tracked as one CVE grouping several internally found vulnerabilities.

Why it is dangerous: Attackers could run scripts in the browsers of administrators or users of the affected management web interfaces, potentially taking over their sessions. Cisco confirms exploitation, and the flaw is rated critical (CVSS 9.3).

Are you affected?

You are affected if you run an affected Cisco Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, or Unity Connection release before the October 2026 hardening release.

Cisco Emergency Responder; Cisco Prime Collaboration Deployment; Cisco Unified Communications Manager (Unified CM); Cisco Unified CM IM & Presence Service; Cisco Unified CM Session Management Edition; Cisco Unity Connection. Specific versions: unknown.

What to do

  1. Update all affected Cisco Unified Communications products to the October 2026 hardening release or later
  2. Check the Cisco advisory cisco-sa-voice-hardening-twgbH9e3 for exact fixed versions for your product
  3. Limit access to the web management interfaces to trusted internal networks until patched

Timeline

  1. 21 Oct 2026, 17:19 UTC
    Publicly disclosed
  2. 21 Oct 2026, 17:19 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 14:49 UTC
    Cisco PSIRT reported on it · Cisco PSIRT
  4. 27 Oct 2026, 14:49 UTC
    Confirmed by Cisco PSIRT

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-76475
CVSS
9.3 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
21 Oct 2026, 17:19 UTC
On Zero Radar
before the radar started
Last change
27 Oct 2026, 14:49 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Cisco Unified Communications products: cross-site scripting flaw (critical) · Zero Radar