Zero Radar
← feed
HighVulnerabilityCVE-2026-76476updated 27 Oct 2026, 14:49 UTC

Cisco Unified Communications products: input validation flaw patched in October 2026 release

Attackers could send specially crafted input that these Cisco phone and calling servers do not properly check, which may let them cause problems or take control of the system. Cisco has released updates to fix it.

Exploited (Cisco PSIRT)Fix availableOfficial, 2 sources
SeverityHighCVSS 8.8 of 10
Being exploited?YesConfirmed by Cisco PSIRT · 27 Oct 2026
Fix available?YesSoftware updates in the October 2026 Cisco Unified Communications Products Security Hardening Release. Specific fixed version numbers: unknown. · since 27 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

What happened

Cisco Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, and Unity Connection contain improper input validation flaws (CWE-20), tracked under CVE-2026-76476 and addressed in an October 2026 hardening release.

Why it is dangerous: The advisory does not describe the exact impact. Organizations running Cisco unified communications servers, which handle business phone calls and messaging, are at risk, and Cisco has confirmed exploitation.

Are you affected?

You are affected if you run Cisco Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, or Unity Connection on a version earlier than the October 2026 hardening release.

Cisco Emergency Responder; Cisco Prime Collaboration Deployment; Cisco Unified Communications Manager (Unified CM); Cisco Unified CM IM&P; Cisco Unified CM Session Management Edition; Cisco Unity Connection. Specific affected versions: unknown.

What to do

  1. Update all Cisco Unified Communications products to the fixed release from the October 2026 hardening release advisory
  2. Check the Cisco advisory cisco-sa-voice-hardening-twgbH9e3 for the exact fixed versions for your product
  3. Review your systems for signs of compromise if you were running an affected version while exposed

Timeline

  1. 21 Oct 2026, 17:19 UTC
    Publicly disclosed
  2. 21 Oct 2026, 17:19 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 14:49 UTC
    Cisco PSIRT reported on it · Cisco PSIRT
  4. 27 Oct 2026, 14:49 UTC
    Confirmed by Cisco PSIRT

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-76476
CVSS
8.8 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
21 Oct 2026, 17:19 UTC
On Zero Radar
before the radar started
Last change
27 Oct 2026, 14:49 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Cisco Unified Communications products: input validation flaw patched in October 2026 release · Zero Radar