CVE-2026-76487
Awaiting Analysis
Awaiting Analysis - Queue
Access Control Bypass in Cisco Unified Communications Manager
Vulnerability report for CVE-2026-76487, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-21
Last updated on: 2026-10-21
Assigner: Cisco Systems, Inc.
Description
Description
A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct access control bypass attacks on an affected device.
This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to access parts of the network that are beyond the scope of their intended access.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Cisco | Cisco | Unified Communications Manager 14 |
| Cisco | Cisco | Unified Communications Manager 14SU1 |
| Cisco | Cisco | Unified Communications Manager 14SU2 |
| Cisco | Cisco | Unified Communications Manager 14SU3 |
| Cisco | Cisco | Unified Communications Manager 15 |
| Cisco | Cisco | Unified Communications Manager 15SU1 |
| Cisco | Cisco | Unified Communications Manager 14SU4 |
| Cisco | Cisco | Unified Communications Manager 14SU4a |
| Cisco | Cisco | Unified Communications Manager 15SU1a |
| Cisco | Cisco | Unified Communications Manager 15SU2 |
| Cisco | Cisco | Unified Communications Manager 15.0.1.13010-1 |
| Cisco | Cisco | Unified Communications Manager 15.0.1.13011-1 |
| Cisco | Cisco | Unified Communications Manager 15.0.1.13012-1 |
| Cisco | Cisco | Unified Communications Manager 15.0.1.13013-1 |
| Cisco | Cisco | Unified Communications Manager 15.0.1.13014-1 |
| Cisco | Cisco | Unified Communications Manager 15.0.1.13015-1 |
| Cisco | Cisco | Unified Communications Manager 15.0.1.13016-1 |
| Cisco | Cisco | Unified Communications Manager 15.0.1.13017-1 |
| Cisco | Cisco | Unified Communications Manager 15SU3a |
| Cisco | Cisco | Unified Communications Manager 14SU5 |
| Cisco | Cisco | Unified Communications Manager 15SU4 |
| Cisco | Cisco | Unified Communications Manager 15SU4a |
| Cisco | Cisco | Unified Communications Manager 14SU6 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-749 | The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted. |
