Cisco Fixes Critical Unified CM Flaws Found With Help From AI in Voice Hardening Release
Do Son 
TL;DR
On October 21, 2026, Cisco published two advisories covering nine Cisco Unified CM vulnerabilities and related voice products. A security hardening release groups internally found bugs into eight CVEs, two of them rated CVSS 9.8. Version 15SU5 fixes everything, while release 14 users must migrate.
- Total: 9 CVEs
- Severity: 3 Critical · 5 High · 1 Medium
- Actively exploited: None confirmed
- Highest severity: 9.8 (Critical · CVSSv3) — CVE-2026-76473
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv3) | Type | Status |
|---|---|---|---|
| CVE-2026-76473 | 9.8 | CWE-74 | Not exploited |
| CVE-2026-76474 | 9.8 | CWE-287 | Not exploited |
| CVE-2026-76475 | 9.3 | CWE-79 | Not exploited |
| CVE-2026-76476 | 8.8 | CWE-20 | Not exploited |
| CVE-2026-76477 | 8.8 | CWE-89 | Not exploited |
| CVE-2026-76478 | 8.8 | CWE-284 | Not exploited |
| CVE-2026-76479 | 7.8 | CWE-22 | Not exploited |
| CVE-2026-76481 | 7.5 | CWE-703 | Not exploited |
Why It Matters
Unified Communications Manager runs enterprise phone systems for many large organizations. A breach can expose calls, voicemail and directory data. Because these Cisco Unified CM vulnerabilities affect every configuration, no setting change can reduce the risk. Notably, Cisco says it found the hardening bugs using “existing testing processes as well as frontier AI models.”
How the Attacks Work
The security hardening release
Rather than list each bug, Cisco grouped them by weakness type. Each CVE score “represents the maximum potential severity of the single most impactful underlying vulnerability” in that group. The Cisco voice hardening advisory lists:
- CVE-2026-76473 (9.8): improper control of a resource through its lifetime
- CVE-2026-76474 (9.8): improper authentication, including bypasses and session fixation
- CVE-2026-76475 (9.3): cross-site scripting
- Five more (7.5-8.8): input validation, SQL injection, access control, path traversal and error handling bugs
The release covers Unified CM, Unified CM IM&P, Unified CM SME, Unity Connection, Emergency Responder and Prime Collaboration Deployment.
Access control bypass
Separately, CVE-2026-76487 (CVSS 5.3) lets an unauthenticated attacker send a crafted HTTP request. According to the Unified CM access control advisory, this could let them “access parts of the network that are beyond the scope of their intended access.” An external researcher reported it.
Exploitation status
Cisco PSIRT “is not aware of any public announcements or malicious use” of these Cisco Unified CM vulnerabilities.
Affected Versions
Releases 14 and 15 are affected, regardless of device configuration.
Patch and Mitigation Steps
- Upgrade release 15 systems to 15SU5.
- Migrate release 14 systems to a fixed release.
- Limit management access to trusted networks.
No workarounds exist, so upgrading is the only fix. Cisco also warns it “may publish separate security advisories” with more detail on individual bugs, so admins should watch for follow-ups.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
