Cisco Unified Communications Products October 2026 security hardening release fixes critical authentication, injection and XSS flaws

What happened

Cisco's October 2026 security hardening release addresses eight internally discovered vulnerabilities across Cisco Emergency Responder, Unified Communications Manager, Unified Communications Manager IM and Presence Service, and Unity Connection. The most severe, CVE-2026-76474 (improper authentication) and CVE-2026-76473 (improper control of a resource through its lifetime), are rated CVSS 3.1 score 9.8. Their vectors describe network-based attacks with low complexity, no privileges, and no user interaction, with high impact on confidentiality, integrity, and availability. CVE-2026-76475 is a cross-site scripting flaw with a CVSS score of 9.3; it also requires no privileges but does require a user to interact with attacker-controlled content. CVE-2026-76476 and CVE-2026-76477 are high-severity network-reachable issues requiring low privileges, with CVE-2026-76477 being an SQL injection issue. CVE-2026-76478 is a local improper access control issue and CVE-2026-76479 is a local path traversal issue. CVE-2026-76481 is a network-reachable denial-of-service issue with no privileges or user interaction required, rated CVSS 7.5. Cisco PSIRT states it is not aware of any public announcements or malicious use of these vulnerabilities. No workarounds are available.

Who is affected

The affected products and versions are: Cisco Emergency Responder 14, 14SU1, 14SU2, 14SU3, 14SU3a, 15, 15SU1, and 15SU1a; Cisco Unified Communications Manager 14, 14SU1, 14SU2, 14SU3, 15, 15SU1, 14SU4, and 14SU4a; Cisco Unified Communications Manager IM and Presence Service 14, 14SU1, 14SU2, 14SU2a, 14SU3, 15, 15SU1, and 14SU4; Cisco Unity Connection 14, 14SU1, 14SU2, 14SU3, 14SU3a, 15, 15SU1, and 14SU4. These are core enterprise telephony and collaboration platforms, often reachable across user networks and sometimes from the internet.

What to do now

1. Use Cisco's advisory to identify the correct October 2026 security hardening release for your affected version train. The CVE record does not list specific fixed version numbers.
2. Apply that release to Cisco Emergency Responder, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM and Presence Service, and Cisco Unity Connection. Prioritise systems reachable from untrusted networks.
3. Cisco states that there are no workarounds; until patching is complete, restrict access to affected management and call-control interfaces.
4. After patching, confirm that authentication and access controls behave as intended and retest voice and collaboration integrations.

How to detect it

Cisco has not provided indicators of compromise for these internally discovered flaws. As an exposure check, confirm that administrative and call-control interfaces for the affected products are not reachable from user, guest or internet segments, and review authentication logs for unusual access attempts.

Beyond the patch

Beyond the patch itself, the two 9.8-rated network-reachable flaws make exposure control the immediate issue: any affected Cisco voice or collaboration system reachable without credentials is the profile to find first. Virtual CISO Services (vCISO) helps locate and prioritise that internet-facing exposure before it is used. Because the hardening release spans injection, authentication and resource-handling defects, Implementation & Assessment Services can verify that the affected Unified Communications deployment is correctly hardened and that the fixes hold under test.