Description
A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct access control bypass attacks on an affected device.

This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to access parts of the network that are beyond the scope of their intended access.
Published: 2026-10-21
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Access Control Bypass
Action: Assess Impact
AI Analysis

Impact

A flaw in Cisco Unified Communications Manager and its Session Management Edition permits an unauthenticated attacker to send specially crafted HTTP requests that bypass established access controls. The vulnerability arises from improper input validation on certain HTTP endpoints, enabling the remote actor to reach network resources that should remain out of scope for their permissions.

Affected Systems

The affected products are Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition. No specific version information is supplied in the advisory, so all deployments of these products should be considered potentially vulnerable until a vendor release states otherwise.

Risk and Exploitability

The CVSS score of 5.3 indicates a medium severity level. No exploit probability score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, unauthenticated access via HTTP, meaning an off‑network adversary could obtain privileges they should not have by simply sending crafted requests to the device.

Generated by OpenCVE AI on October 21, 2026 at 21:07 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check Cisco’s security advisories for an updated patch or firmware release addressing this access control flaw and apply it as soon as possible.
  • Restrict HTTP traffic to the Unified Communications Manager to trusted network segments or IP ranges, and enforce firewall rules or ACLs that limit incoming requests from unknown or untrusted sources.
  • Review and monitor system logs for anomalous HTTP requests that could indicate an attempt to exploit input validation weaknesses, and adjust the application’s input validation or access control policies accordingly.

Generated by OpenCVE AI on October 21, 2026 at 21:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Description A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct access control bypass attacks on an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to access parts of the network that are beyond the scope of their intended access.
Title Cisco Unified Communications Manager Improper Access Control Vulnerability
Weaknesses CWE-749
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published:

Updated: 2026-10-21T16:16:54.579Z

Reserved: 2026-08-19T12:02:03.639Z

Link: CVE-2026-76487

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-21T17:19:08.047

Modified: 2026-10-21T18:54:37.403

Link: CVE-2026-76487

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T21:15:16Z

Weaknesses
  • CWE-749

    Exposed Dangerous Method or Function