Zero Radar
← feed
HighVulnerabilityCVE-2026-76477updated 27 Oct 2026, 14:49 UTC

Cisco Unified Communications products: SQL injection flaw (CVE-2026-76477)

Attackers may be able to sneak database commands into normal requests and read or change data stored by the phone system. Cisco confirms this flaw is being exploited.

Exploited (Cisco PSIRT)Fix availableOfficial, 2 sources
SeverityHighCVSS 8.8 of 10
Being exploited?YesConfirmed by Cisco PSIRT · 27 Oct 2026
Fix available?YesSoftware hardening releases from Cisco's October 2026 Unified Communications release (see Cisco advisory cisco-sa-voice-hardening-twgbH9e3); specific fixed version numbers unknown. · since 27 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends crafted inputInput reaches a web or admin interface
  2. 2Input not sanitizedSpecial characters pass into SQL command
  3. 3Database runs attacker queryAttacker-controlled SQL executes
  4. 4Data read or changedStored call and user data exposed
  5. ResultAttacker reads or alters server database

What happened

An SQL injection weakness (CWE-89) in Cisco Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME and Unity Connection allows special characters in SQL commands to be neutralized improperly.

Why it is dangerous: A successful attack could expose or alter call-system and user data on the server. Organizations running these Cisco voice and collaboration servers are at risk.

Are you affected?

You are affected if you run an unpatched version of Cisco Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, or Unity Connection.

Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Unified CM IM&P, Unified CM SME, Cisco Unity Connection; specific affected versions unknown from the provided material.

What to do

  1. Check the Cisco advisory cisco-sa-voice-hardening-twgbH9e3 for the fixed version of your product
  2. Update Cisco Emergency Responder, Unified CM, Unified CM IM&P, Unified CM SME, Prime Collaboration Deployment, or Unity Connection to a fixed release
  3. Confirm the update is installed and review logs for unusual database query activity

Timeline

  1. 21 Oct 2026, 17:19 UTC
    Publicly disclosed
  2. 21 Oct 2026, 17:19 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 14:49 UTC
    Cisco PSIRT reported on it · Cisco PSIRT
  4. 27 Oct 2026, 14:49 UTC
    Confirmed by Cisco PSIRT

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-76477
CVSS
8.8 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
21 Oct 2026, 17:19 UTC
On Zero Radar
before the radar started
Last change
27 Oct 2026, 14:49 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Cisco Unified Communications products: SQL injection flaw (CVE-2026-76477) · Zero Radar