The CVE tracks improper access control deficiencies that could enable an attacker to bypass authentication or authorization checks on Cisco Emergency Responder, Unified Communications Manager, and related services. The vulnerability is categorized under CWE‑284, which describes unauthorized access to resources or operations. According to the advisory, these flaws are internal security findings that have been remedied in the October 2026 hardening release.

Affected Cisco products include Emergency Responder, Unified Communications Manager, Unified Communications Manager IM & Presence Service, Unified Communications Manager Session Management Edition, and Unity Connection. No specific product versions are listed in the advisory.

Scored 8.8 on CVSS, indicating a high severity risk. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The CVE description indicates that improper access control can be exploited; while the advisory does not explicitly state that remote exploitation is possible, it is inferred that an attacker could potentially exploit the flaw remotely if the vulnerable services are exposed, making the risk significant for exposed or poorly segmented networks.