CISCO Security Advisory
Published Date: Not specified
CVE: CVE-2026-76487
Advisory Summary
🔔 ⚠️ Cisco Unified Communications Manager Access Control Bypass (CVE-2026-76487)
- Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (Unified CM SME) have an access control bypass risk.
- The root cause is improper input validation for certain HTTP requests.
- A remote, unauthenticated attacker could send a crafted HTTP request to bypass access controls and reach resources outside the attacker’s intended authorization scope.
- Rating: Medium
- The most concerning operational risk is lateral reach / unauthorized access into portions of the communications network beyond the attacker’s normal access boundaries.
- Organizations exposing Unified CM / SME web/HTTP surfaces to untrusted networks (including misconfigured reverse proxies, edge devices, or “temporary” firewall openings).
- Environments where attackers could reach signaling/application paths used by Unified CM web components.
- Cisco states there are no workarounds for this vulnerability.
- That makes patching and compensating controls the primary mitigation path.
- Restrict inbound access to Unified CM/SME interfaces from trusted management networks only.
- Block unnecessary HTTP access at the perimeter; ensure only required ports/routes are reachable.
- Since the issue is triggered via specific crafted HTTP requests, reduce attack surface first (network controls), then complete patch rollout to close the input validation gap.
đź“Ś
-2026-76487
Reference: Vendor Advisory