Cisco Unified Communications Products: October 2026 hardening release fixes multiple vulnerabilities across voice/collaboration suite (CVE-2026-76473 to CVE-2026-76481)
Severity: critical · Patch status: patched · Since 2026-10-21 · CVE-2026-76473, CVE-2026-76474, CVE-2026-76475, CVE-2026-76476, CVE-2026-76477, CVE-2026-76478, CVE-2026-76479, CVE-2026-76481, CVE-2026-76487
Cisco published a critical hardening release on 2026-10-21 addressing multiple internally discovered vulnerabilities across Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, and Unity Connection. Issues are grouped by CWE into eight CVEs (CVE-2026-76473 through CVE-2026-76481) covering injection (CWE-74, max 9.8), improper authentication (CWE-287, 9.8), XSS (9.3), input validation, SQL injection, access control (all 8.8), path traversal (7.8), and exceptional-condition handling (7.5). Vulnerabilities affect the products regardless of configuration, were found during internal testing including use of frontier AI models, and are not known to be exploited. No workarounds exist; fixed software is available — release 15SU5, while release 14 users must migrate to a fixed release.
What to do
- Upgrade Unified CM, Unified CM IM&P, Unified CM SME, Unity Connection, Emergency Responder, and Prime Collaboration Deployment to the first fixed releases (15SU5 for release 15; migrate off release 14)
- Prioritise internet-exposed Unified CM and Unity Connection instances given 9.8 unauthenticated network-attack vectors
- Check for follow-up Cisco advisories detailing individual vulnerabilities and apply Snort rules 67356/67358 for detection
- Since no workarounds exist, restrict network access to management interfaces until patching is complete
Fixed versions
- 15SU5 (Release 14: migrate to a fixed release)
Sources
All live incidents on Threat Watch
