CVE-2026-76475
Cross-site scripting lets an attacker run malicious scripts in Cisco Unified Communications web interfaces
CVE-2026-76475 is a cross-site scripting vulnerability caused by improper neutralization of input during web page generation. It affects Cisco Emergency Responder, Prime Collaboration Deployment, Unified Communications Manager, IM and Presence Service, Session Management Edition, and Unity Connection. Cisco found it during an internal security review and released a hardening update, but no fixed version numbers are listed. It is not on CISA's known-exploited list, so there is no evidence of active exploitation.
Cisco Cisco Emergency Responder · Updated 28 Oct · From the public records
Am I affected?
The records do not list fixed versions yet. Check the vendor's advisory below.
What to do
- Apply the October 2026 Cisco Unified Communications hardening release, since the record gives no specific fixed version numbers.
- Check Cisco's security advisory for the exact update matching your product and deployment.
- Restrict access to the affected web interfaces until the update is installed.
- Monitor Cisco advisories for any follow-up guidance.
What happened
- 27 OctCisco published the Unified Communications Products Security Hardening Release covering CVE-2026-76475 and other internally discovered vulnerabilities.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-76475 | Cisco Unified Communications Products Hardening Release: October 2026 - Cross-site Scripting Vulnerabilities | critical 9.3 | No | 0.3% |
Our reporting
We have not reported on it. It is here because the sources below did.