{"id":"CVE-2026-76474","published":"2026-10-21T17:19:07.113","lastModified":"2026-10-22T23:19:07.677","description":"As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-76474 are related to issues concerning improper authentication that are grouped under the Common Weakness Enumeration (CWE) Class CWE-287.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Improper authentication (CWE-287) in multiple Cisco Unified Communications products allows unauthenticated remote attackers to bypass security controls, potentially leading to full system compromise.","exploitability":"Exploitation is highly likely due to network accessibility (AV:N), low attack complexity (AC:L), and no required privileges or user interaction (PR:N, UI:N).","blast_radius":"Successful exploitation could result in complete confidentiality, integrity, and availability impact across affected systems, enabling full remote takeover.","remediation":"Upgrade to the specific fixed version(s) identified in Cisco's security advisory for each affected product; since no fixed versions are listed in the description, apply the hardening release referenced in the advisory and follow Cisco's official patch guidance precisely.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","cwe-287","unauth-access","uc-critical","hardening-release"],"model":"garnet-coder","analyzedAt":"2026-10-24T08:55:50.273Z"}}