Description
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.

The vulnerabilities tracked by CVE-2026-76478 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.
Published: 2026-10-21
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: Improper Access Control to sensitive services within Cisco Unified Communications architectures
Action: Apply Patch
AI Analysis

Impact

The vulnerability allows an attacker to bypass authentication or authorization controls on Cisco Emergency Responder, Unified Communications Manager and related services, potentially enabling unauthorized management actions or data exfiltration. The flaw is a classic improper access control issue that could compromise confidentiality, integrity, and availability of voice and video communication systems.

Affected Systems

Affected Cisco products include Emergency Responder, Unified Communications Manager, Unified Communications Manager IM & Presence Service, Unified Communications Manager Session Management Edition, and Unity Connection. No specific product versions are listed in the advisory.

Risk and Exploitability

Scored 8.8 on CVSS, indicating a high severity risk. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers could exploit the flaw remotely if the vulnerable services are exposed, making the risk significant for exposed or poorly segmented networks.

Generated by OpenCVE AI on October 21, 2026 at 21:09 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Deploy the October 2026 hardening release updates for all affected Cisco Unified Communications products
  • Reconfigure access controls to enforce least privilege and deny extraneous permissions after the update
  • Enable and monitor comprehensive logging and audit trails for unauthorized access attempts

Generated by OpenCVE AI on October 21, 2026 at 21:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Description As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76478 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.
Title Cisco Unified Communications Products Hardening Release: October 2026 - Improper Access Control Vulnerabilities
Weaknesses CWE-284
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published:

Updated: 2026-10-21T16:15:47.937Z

Reserved: 2026-08-19T12:02:03.639Z

Link: CVE-2026-76478

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-21T17:19:07.650

Modified: 2026-10-21T18:54:37.403

Link: CVE-2026-76478

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T21:15:16Z

Weaknesses