Description
A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct access control bypass attacks on an affected device.

This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to access parts of the network that are beyond the scope of their intended access.
Published: 2026-10-21
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Access Control Bypass
Action: Assess Impact
AI Analysis

Impact

A flaw in Cisco Unified Communications Manager and its Session Management Edition allows an unauthenticated attacker to send crafted HTTP requests that bypass established access controls. Improper input validation on specific HTTP endpoints enables the remote actor to reach network resources that should otherwise be out of scope for their permissions, potentially granting unauthorized access to sensitive parts of the network.

Affected Systems

Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition. No version information is provided, so all current deployments could be vulnerable until a vendor patch or update is released.

Risk and Exploitability

The CVSS score of 5.3 indicates a medium severity. An exploit probability score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote and unauthenticated via HTTP, meaning an off‑network adversary could obtain higher privileges by sending specially crafted requests to the device.

Generated by OpenCVE AI on October 22, 2026 at 05:01 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check Cisco’s security advisories for an updated patch or firmware release addressing the access control flaw and apply it as soon as possible.
  • Limit HTTP access to the Unified Communications Manager by restricting traffic to trusted IP ranges or network segments and enforce firewall or ACL rules to block unknown or untrusted sources.
  • Monitor system logs for anomalous HTTP requests that could indicate exploitation attempts and adjust application input validation or access control policies accordingly.

Generated by OpenCVE AI on October 22, 2026 at 05:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 04:00:00 +0000

Type Values Removed Values Added
First Time appeared Cisco
Cisco cisco Unified Communications Manager
Vendors & Products Cisco
Cisco cisco Unified Communications Manager

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Description A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct access control bypass attacks on an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to access parts of the network that are beyond the scope of their intended access.
Title Cisco Unified Communications Manager Improper Access Control Vulnerability
Weaknesses CWE-749
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Cisco Cisco Unified Communications Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published:

Updated: 2026-10-22T13:37:53.516Z

Reserved: 2026-08-19T12:02:03.639Z

Link: CVE-2026-76487

cve-icon Vulnrichment

Updated: 2026-10-22T13:35:33.117Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-21T17:19:08.047

Modified: 2026-10-22T14:17:46.920

Link: CVE-2026-76487

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T05:15:07Z

Weaknesses
  • CWE-749

    Exposed Dangerous Method or Function