Cisco has released security updates for multiple Unified Communications products, addressing eight vulnerabilities across different weakness categories. Published on October 21, 2026, the advisory includes vulnerabilities with severity scores as high as CVSS 9.8.
The affected products are used by organisations for enterprise calling, messaging, voicemail and collaboration. Security weaknesses in these systems require attention, particularly when they support business-critical communication.
Cisco identified the vulnerabilities through internal security testing. The company has not reported any known active exploitation or public announcements relating to these issues.
Products affected
The advisory covers the following Cisco products:
- Cisco Emergency Responder
- Cisco Prime Collaboration Deployment
- Cisco Unified Communications Manager (Unified CM)
- Cisco Unified Communications Manager IM & Presence Service
- Cisco Unified Communications Manager Session Management Edition
- Cisco Unity Connection
Organisations using these products should check their installed software versions against Cisco’s affected software information to determine whether an upgrade is required.
Vulnerabilities addressed
Cisco has listed eight CVEs covering different types of security weaknesses.
- CVE-2026-76473 — CVSS 9.8: Improper handling of special elements, classified under CWE-74.
- CVE-2026-76474 — CVSS 9.8: Authentication-related weaknesses, including issues involving authentication bypass and session handling.
- CVE-2026-76475 — CVSS 9.3: Cross-site scripting (XSS), caused by insufficient input neutralisation in web applications.
- CVE-2026-76476 — CVSS 8.8: Improper input validation.
- CVE-2026-76477 — CVSS 8.8: SQL injection-related weakness.
- CVE-2026-76478 — CVSS 8.8: Improper access control.
- CVE-2026-76479 — CVSS 7.8: Path traversal, involving insufficient restrictions on file paths.
- CVE-2026-76481 — CVSS 7.5: Improper handling of exceptional conditions.
These vulnerabilities affect different areas of application and system security, including authentication, input handling, access control and web application processing. The specific impact depends on the vulnerability and the affected product version.
Reader Impact
Organisations using affected Cisco Unified Communications products may face risks involving unauthorised access and weaknesses in application security. IT and security teams should identify vulnerable deployments and prioritise remediation to reduce potential exposure.
What organisations should do
Cisco has released software updates to address the vulnerabilities and confirmed that no workarounds are available.
The advisory provides the following upgrade guidance:
- Release 14: Migrate to a fixed release.
- Release 15: Upgrade to Release 15SU5.
Administrators should verify the exact fixed release applicable to their product and current software version using Cisco’s official advisory.
Before upgrading, review system dependencies, arrange suitable backups and plan a maintenance window to minimise disruption to business communications.
After applying the updates, confirm the installed software version and test essential services, including calling, messaging, voicemail and collaboration functions. Administrative interfaces should also remain restricted to authorised users and trusted network segments.
Final word
Organisations running Cisco Unified Communications products should review the advisory, identify affected software versions and apply the recommended security updates. Timely patching and proper validation will help maintain the security and reliability of enterprise communication systems.
