CVE-2026-76475

Awaiting Analysis Awaiting Analysis - Queue

Cross-Site Scripting in Cisco Unified Communications Manager

Publication date: 2026-10-21

Last updated on: 2026-11-07

Assigner: Cisco Systems, Inc.

Description

As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76475 are related to issues concerning improper neutralization of input during web page generation that are grouped under the Common Weakness Enumeration (CWE) Base CWE-79.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-11-07

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-76475

EUVD

EUVD-2026-107387

Affected Vendors & Products

Vendor	Product	Version / Range
Cisco	Cisco Emergency Responder	14
Cisco	Cisco Emergency Responder	14SU1
Cisco	Cisco Emergency Responder	14SU2
Cisco	Cisco Emergency Responder	14SU3
Cisco	Cisco Emergency Responder	14SU3a
Cisco	Cisco Emergency Responder	15
Cisco	Cisco Emergency Responder	15SU1
Cisco	Cisco Emergency Responder	15SU1a
Cisco	Cisco Emergency Responder	14SU4
Cisco	Cisco Emergency Responder	15SU2
Cisco	Cisco Emergency Responder	15SU3
Cisco	Cisco Emergency Responder	14SU5
Cisco	Cisco Emergency Responder	15SU4
Cisco	Cisco Emergency Responder	14SU6
Cisco	Cisco Unified Communications Manager	14
Cisco	Cisco Unified Communications Manager	14SU1
Cisco	Cisco Unified Communications Manager	14SU2
Cisco	Cisco Unified Communications Manager	14SU3
Cisco	Cisco Unified Communications Manager	15
Cisco	Cisco Unified Communications Manager	15SU1
Cisco	Cisco Unified Communications Manager	14SU4
Cisco	Cisco Unified Communications Manager	14SU4a
Cisco	Cisco Unified Communications Manager	15SU1a
Cisco	Cisco Unified Communications Manager	15SU2
Cisco	Cisco Unified Communications Manager	15.0.1.13010-1
Cisco	Cisco Unified Communications Manager	15.0.1.13011-1
Cisco	Cisco Unified Communications Manager	15.0.1.13012-1
Cisco	Cisco Unified Communications Manager	15.0.1.13013-1
Cisco	Cisco Unified Communications Manager	15.0.1.13014-1
Cisco	Cisco Unified Communications Manager	15.0.1.13015-1
Cisco	Cisco Unified Communications Manager	15.0.1.13016-1
Cisco	Cisco Unified Communications Manager	15.0.1.13017-1
Cisco	Cisco Unified Communications Manager	15SU3a
Cisco	Cisco Unified Communications Manager	14SU5
Cisco	Cisco Unified Communications Manager	15SU4
Cisco	Cisco Unified Communications Manager	15SU4a
Cisco	Cisco Unified Communications Manager	14SU6
Cisco	Cisco Unified Communications Manager IM and Presence Service	14
Cisco	Cisco Unified Communications Manager IM and Presence Service	14SU1
Cisco	Cisco Unified Communications Manager IM and Presence Service	14SU2
Cisco	Cisco Unified Communications Manager IM and Presence Service	14SU2a
Cisco	Cisco Unified Communications Manager IM and Presence Service	14SU3
Cisco	Cisco Unified Communications Manager IM and Presence Service	15
Cisco	Cisco Unified Communications Manager IM and Presence Service	15SU1
Cisco	Cisco Unified Communications Manager IM and Presence Service	14SU4
Cisco	Cisco Unified Communications Manager IM and Presence Service	15SU2
Cisco	Cisco Unified Communications Manager IM and Presence Service	15SU3
Cisco	Cisco Unified Communications Manager IM and Presence Service	14SU5
Cisco	Cisco Unified Communications Manager IM and Presence Service	15SU4
Cisco	Cisco Unified Communications Manager IM and Presence Service	14SU6
Cisco	Cisco Unity Connection	14
Cisco	Cisco Unity Connection	14SU1
Cisco	Cisco Unity Connection	14SU2
Cisco	Cisco Unity Connection	14SU3
Cisco	Cisco Unity Connection	14SU3a
Cisco	Cisco Unity Connection	15
Cisco	Cisco Unity Connection	15SU1
Cisco	Cisco Unity Connection	14SU4
Cisco	Cisco Unity Connection	15SU2
Cisco	Cisco Unity Connection	15SU3
Cisco	Cisco Unity Connection	14SU5
Cisco	Cisco Unity Connection	15SU4
Cisco	Cisco Unity Connection	14SU6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

CVE-2026-76475 is a vulnerability in Cisco Unified Communications Products classified under CWE-79. It involves improper neutralization of input during web page generation, which could allow attackers to inject malicious scripts into web pages. This flaw may lead to cross-site scripting (XSS) attacks.

Detection Guidance

Detection involves checking for vulnerable versions of Cisco Unified Communications Products. Use Cisco's official tools or commands like 'show version' on affected systems to verify software versions. Compare installed versions against the fixed versions listed in Cisco's advisory.

Impact Analysis

This vulnerability could allow attackers to inject malicious scripts into web pages, potentially leading to unauthorized actions on behalf of users or theft of sensitive information. The high CVSS score of 9.3 indicates a significant risk of exploitation.

Mitigation Strategies

Immediately upgrade affected Cisco products to the fixed software versions provided by Cisco. Since no workarounds exist, patching is the only mitigation. Monitor Cisco's advisory for updates and apply patches as soon as possible.

Hi! I’m here to help you understand CVE-2026-76475. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...