CVE-2026-76419
Received Received - Intake

Reflected XSS in Cisco Unified Communications Manager

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: Cisco Systems, Inc.

Description
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-76419
EUVD
EUVD-2026-116972

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a cross-site scripting (XSS) vulnerability in Cisco Unified Communications Manager and Unified CM SME. It occurs because the web-based management interface does not properly validate user input. An attacker can exploit this by tricking a user into clicking a malicious link, allowing them to run arbitrary scripts in the interface or steal sensitive browser data.

Detection Guidance

This vulnerability is specific to Cisco Unified Communications Manager (Unified CM) and Unified CM SME web-based management interfaces. Detection involves checking the software version of your Cisco Unified CM or Unified CM SME instances. If the version is earlier than Release 15SU5, the system is vulnerable. Use commands like 'show version' on Cisco devices or check the administrative interface for version information.

Impact Analysis

If exploited, this vulnerability could let an attacker execute malicious scripts in your Cisco management interface or access sensitive information stored in your browser. This might lead to unauthorized actions, data theft, or further compromise of your system.

Compliance Impact

This XSS vulnerability could expose sensitive browser-based information, potentially leading to unauthorized access to personal or health data. This may impact compliance with GDPR (data protection) and HIPAA (health information privacy) by increasing the risk of data breaches or unauthorized disclosure.

Mitigation Strategies

Immediately upgrade to Cisco Unified CM and Unified CM SME Release 15SU5 or later. Cisco has released software updates to address this issue, and no workarounds are available. Ensure all instances are updated to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76419. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...