CVE-2026-76477
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Cisco conducted a comprehensive internal security review of Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager, Cisco Unified CM IM & Presence, Cisco Unified CM SME, and Cisco Unity Connection, resulting in software hardening releases. The vulnerabilities tracked by CVE-2026-76477 relate to improper neutralization of special elements used in SQL commands (CWE-89).
Risk Assessment
SQL injection vulnerabilities in Cisco collaboration products may allow an attacker to manipulate database queries, potentially leading to data disclosure or modification.
Recommendation
Apply the hardening updates released by Cisco for the listed products and review database access configurations.
Other vulnerabilities in Cisco Unified Communications Manager
See all- CVE-2017-6791High
A vulnerability in the Trust Verification Service (TVS) of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of Transport Layer Security (TLS) traffic by the affected software.
- CVE-2017-6757High
A vulnerability in Cisco Unified Communications Manager 10.5(2.10000.5), 11.0(1.10000.10), and 11.5(1.10000.6) allows an authenticated, remote attacker to conduct a blind SQL injection attack. The issue is due to a failure to validate user-supplied input used in SQL queries that bypass protection filters.
- CVE-2016-6364High
The User Data Services (UDS) API implementation in Cisco Unified Communications Manager 11.5 allows remote attackers to bypass intended access restrictions and obtain sensitive information via unspecified API calls.
- CVE-2026-20230HighActively exploited
A vulnerability in Cisco Unified Communications Manager and Unified CM SME allows an unauthenticated remote attacker to perform SSRF attacks. The attacker can write files to the OS, potentially leading to root privilege escalation. WebDialer service must be enabled (disabled by default).
- CVE-2026-76487Medium
A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct access control bypass attacks on an affected device. This is due to improper input validation for specific HTTP requests; an attacker could send a crafted HTTP request to access parts of the network beyond their intended scope.
- CVE-2025-20361Medium
XSS vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Unified CM SME. An authenticated remote attacker can inject malicious code into specific pages, allowing script execution in the interface context or access to sensitive browser information.
Original NVD description (English source)
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76477 are related to issues concerning improper neutralization of special elements used in an SQL command that are grouped under the Common Weakness Enumeration (CWE) Base CWE-89.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS