CVE-2026-76475criticalCWE-79

CVE-2026-76475: critical vulnerability in Cisco Emergency Responder

Cisco Unified Communications Products Hardening Release: October 2026 - Cross-site Scripting Vulnerabilities

Published · Updated

Follow this CVE+ Monitor Cisco Unified Communications Manager+ Monitor Cisco Unity Connection

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. It has an official Brazilian government alert.

ssvc Trackcvss 9.3epss 0.3%
from disclosure to weapon6 days
Published on NVDOct 21
1st PoC+6d
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76475 are related to issues concerning improper neutralization of input during web page generation that are grouped under the Common Weakness Enumeration (CWE) Base CWE-79.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Affected products
Cisco · Cisco Emergency ResponderCisco · Cisco Unified Communications ManagerCisco · Cisco Unified Communications Manager IM and Presence ServiceCisco · Cisco Unity Connection
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Cisco Emergency Responder

In the same product, most dangerous first.

CVE-2026-20230HIGHCisco Unified Communications Manager Server-Side Request Forgery VulnerabilityEPSS 88.5%KEVCVE-2026-20045HIGHCisco Unified Communications Products Remote Code Execution VulnerabilityEPSS 4.5%KEVCVE-2020-3177HIGHCisco Unified Communications Manager Path Traversal VulnerabilityEPSS 2.8%CVE-2023-20101CRITICALCVE-2023-20101EPSS 2.6%CVE-2019-1837MEDIUMCisco Unified Communications Manager Denial of Service VulnerabilityEPSS 2.4%CVE-2024-20253CRITICALCVE-2024-20253EPSS 2.4%