Vulnerability in Cisco Unified Communications Manager

[ Description ]Official description

A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct access control bypass attacks on an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to access parts of the network that are beyond the scope of their intended access.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• NCSC-NL22 Oct 2026NCSC-2026-0451

  Vulnerabilities fixed in Cisco Expressway Series Translated from Dutch

  Probability/damage M/HCVE-2026-76435CVE-2026-76466CVE-2026-76473+16 more CVEs
• BSI CERT-Bund21 Oct 2026WID-SEC-2026-4106

  Cisco products (Emergency Responder, Prime Collaboration, Unified Communications Manager and Unity Connection): Multiple vulnerabilities Translated from German

  Risk highCVE-2026-76477CVE-2026-76476CVE-2026-76487+6 more CVEs

[ References ]References

• sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-acc…