October 2026 Cisco Unified Communications Products hardening release addresses critical authentication and other vulnerabilities

What happened

Cisco conducted an internal security review of its Unified Communications products and released a hardening update addressing eight vulnerabilities. The most severe are improper authentication (CVE-2026-76474) and improper control of a resource through its lifetime (CVE-2026-76473). Both are rated critical with a CVSS score of 9.8 and can be reached over the network with no credentials and no user interaction, giving an attacker high impact on confidentiality, integrity and availability.

A further critical issue is cross-site scripting (CVE-2026-76475), which is network reachable without privileges but requires a user to interact; it can lead to high confidentiality and integrity impact within a changed scope. Other high-severity issues include SQL injection (CVE-2026-76477) and improper input validation (CVE-2026-76476) requiring low privileges, local path traversal (CVE-2026-76479) and local improper access control (CVE-2026-76478), plus an availability-impacting exception handling flaw reachable without authentication (CVE-2026-76481).

Cisco PSIRT states it is not aware of any public announcements or malicious use of the vulnerabilities described in the advisory. The vendor rates the overall advisory as critical.

Who is affected

Affected products and releases are:

• Cisco Emergency Responder: 14, 14SU1, 14SU2, 14SU3, 14SU3a, 15, 15SU1, 15SU1a
• Cisco Unified Communications Manager: 14, 14SU1, 14SU2, 14SU3, 15, 15SU1, 14SU4, 14SU4a
• Cisco Unified Communications Manager IM and Presence Service: 14, 14SU1, 14SU2, 14SU2a, 14SU3, 15, 15SU1, 14SU4
• Cisco Unity Connection: 14, 14SU1, 14SU2, 14SU3, 14SU3a, 15, 15SU1, 14SU4

These are the core call-control, presence and voicemail platforms, usually deployed as high-availability clusters and often reachable from internal networks; some organisations expose administrative interfaces to the internet.

What to do now

1. Confirm whether you run Cisco Emergency Responder, Unified CM, IM and Presence Service, or Unity Connection on a listed 14 or 15 release, including SU releases.
2. Apply Cisco's October 2026 software hardening release for each affected product. No fixed version numbers are listed in the data shown on this page; confirm the exact fixed build from Cisco's advisory for your product and version.
3. Prioritise systems reachable over the network, especially any management interfaces exposed beyond the voice VLAN.
4. Cisco states there are no workarounds that address these vulnerabilities, so plan the update as the primary remediation.

How to detect it

Cisco's advisory does not list indicators of compromise for these vulnerabilities. Because several of the most severe issues are reachable over the network without credentials, review authentication and access logs for unexpected or repeated attempts against the affected call-control, presence and voicemail systems, particularly any interface exposed outside the voice network.

Beyond the patch

This bundle is a reminder that voice infrastructure is a business-critical attack surface, not just an internal utility. Several of the most severe flaws here are reachable over the network without credentials, which is exactly what an exposure-management review should catch before an attacker does. Our Implementation & Assessment Services can test and harden these Cisco deployments, and Virtual CISO Services (vCISO) can help you map exposed services and keep patching prioritised against the risk that matters most.