Cisco published a security advisory on October 21, 2026, covering eight CVEs across six Cisco communications product families, including Unified CM. INCIBE-CERT issued a related alert on October 22. Cisco lists 15SU5 as the fixed release for release 15; installations on release 14 must migrate to a fixed release. Cisco says there are no workarounds.
Which Cisco communications products are affected?
Cisco lists six affected product families: Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified CM IM & Presence Service, Cisco Unified CM Session Management Edition, and Cisco Unity Connection. Cisco says the vulnerabilities affect the listed products regardless of device configuration.
What the CVE, CWE, and CVSS entries mean
A CVE is an identifier for a vulnerability; a CWE groups types of software weakness; and CVSS scores rate severity. Cisco’s advisory assigns each CVE grouping a CWE category and a maximum CVSS score for the most impactful underlying vulnerability in that category. The scores are class-level maxima, not complete technical descriptions of each vulnerability.
INCIBE-CERT classified three vulnerabilities as critical and five as high. The table pairs that severity split with Cisco’s CWE categories and score values.
| CVE | CWE category | Maximum CVSS score for the CWE category | INCIBE-CERT severity |
| CVE-2026-76473 | CWE-74, improper control of a resource through its lifetime | 9.8 | Critical |
| CVE-2026-76474 | CWE-287, improper authentication | 9.8 | Critical |
| CVE-2026-76475 | CWE-79, improper neutralization of input during web-page generation | 9.3 | Critical |
| CVE-2026-76476 | CWE-20, improper input validation | 8.8 | High |
| CVE-2026-76477 | CWE-89, improper neutralization of special elements used in an SQL command | 8.8 | High |
| CVE-2026-76478 | CWE-284, improper access control | 8.8 | High |
| CVE-2026-76479 | CWE-22, improper limitation of a pathname to a restricted directory | 7.8 | High |
| CVE-2026-76481 | CWE-703, improper handling of exceptional conditions | 7.5 | High |
Cisco’s fix for releases 15 and 14
Cisco lists 15SU5 as the first fixed release for release 15. Installations on release 14 must migrate to a fixed release. Cisco says no workaround addresses these vulnerabilities. The Cisco security advisory contains the release guidance.
Cisco says its internal security testing used existing testing processes and frontier AI models to find the vulnerabilities.
The PHP advisory is separate
Cisco also published a separate October 2026 advisory about PHP vulnerabilities affecting Cisco products, with its own CVEs and product list. It is separate from the eight CVE groupings in the Unified Communications advisory. Cisco’s PHP security advisory covers that issue. Which updates apply depends on the products in a particular installation and the affected-product information in each advisory.
What Cisco and INCIBE-CERT said about exploitation
When Cisco published its advisory on October 21, Cisco’s Product Security Incident Response Team said it was unaware of public announcements or malicious use. In its October 22 alert, INCIBE-CERT marked exploitation as “No” for the listed CVEs and said that status could change.
