Cisco patches improper access control flaw in Unified CM and Unified CM SME (CVE-2026-76487)
Cisco disclosed a medium-severity (CVSS 5.3) improper access control vulnerability in Unified Communications Manager and Unified CM Session Management Edition caused by improper input validation of certain HTTP requests. An unauthenticated remote attacker could send a crafted HTTP request to bypass access controls and reach network areas beyond their intended scope. Cisco has released fixed software; no workarounds exist. Cisco PSIRT is not aware of any public exploitation.
SECURITY · COLLABORATION · NETWORK · SECURITY ADVISORY · VULNERABILITY
PUBLISHED OCT 23, 2026 19:47 UTC
WHAT CHANGED
Cisco published advisory cisco-sa-cucm-access-PW9e8Jt2 describing CVE-2026-76487, an improper access control issue (CWE-749) affecting Unified CM and Unified CM SME regardless of device configuration. The flaw stems from improper input validation for specific HTTP requests, allowing an unauthenticated remote attacker to bypass access controls via a crafted HTTP request. Release 14 has no fix and must migrate to a fixed release; Release 15 is fixed in 15SU5. This fix is also part of the broader October 2026 Cisco Unified Communications Products Security Hardening Release.
WHY IT MATTERS
Because exploitation requires no authentication and could let an attacker reach network segments outside their intended access scope, unpatched Unified CM/Unified CM SME deployments are exposed to unauthorized lateral access. With no workarounds available, administrators must apply the fixed software to remediate exposure, particularly since Release 14 has no direct fix path and requires migration.
WHO IS AFFECTED
- ROLES
- Network administratorsSecurity administrators
- PRODUCTS
- Cisco Unified Communications Manager (Unified CM)Cisco Unified Communications Manager Session Management Edition (Unified CM SME)
- FEATURES
- HTTP request handling / access control
- CONFIGURATIONS
- Affected regardless of device configuration
- ENVIRONMENTS
- On-premises Unified CM/Unified CM SME deployments, release 14 and 15
WHAT TO DO
- 01HIGH
Upgrade Cisco Unified CM and Unified CM SME release 14 by migrating to a fixed release.
DOCUMENTATION - 02
- 03MEDIUM
Verify via Cisco Bug ID CSCwv00936 the most current affected and fixed release details before planning the upgrade.
DOCUMENTATION - 04MEDIUM
Confirm hardware/software compatibility and sufficient memory before applying the fixed release.
TIMELINE
- ANNOUNCED
- OCT 21, 2026
SOURCES
- PRIMARY SOURCECISCO
Cisco Security Advisory: Cisco Unified Communications Manager Improper Access Control Vulnerability
PUBLISHED OCT 21, 2026VIEW SOURCE
VERIFICATION
ShiftWire summarizes and analyzes changes from the cited sources. Always review the primary source before implementing material changes.