Cisco Patches Unified Communications Manager Access Control Vulnerability

Cisco has released security updates for a vulnerability in its Unified Communications Manager (Unified CM) and Unified Communications Manager Session Management Edition (Unified CM SME) products.
Tracked as CVE-2026-76487, the flaw could allow an unauthenticated remote attacker to bypass access controls and reach parts of a network beyond their intended access permissions.

Cisco published the security advisory on 21 October 2026, classifying the vulnerability as medium severity with a CVSS 3.1 base score of 5.3. The company confirmed that software updates are available and that no workaround addresses the vulnerability.

For organisations relying on Cisco's enterprise communications infrastructure, the advisory highlights the importance of reviewing deployed software versions and applying the appropriate security updates.

What is CVE-2026-76487?

CVE-2026-76487 is an improper access control vulnerability caused by insufficient input validation for specific HTTP requests.

According to Cisco, an attacker could exploit the flaw by sending a specially crafted HTTP request to an affected device. If successful, the attack could allow access to parts of the network outside the attacker's intended access scope.

The advisory identifies the following details:

Source: Cisco's official security advisory.

The published CVSS vector indicates that the vulnerability is remotely exploitable without authentication and has a low-complexity attack path. Its stated impact includes limited integrity impact, while the vector records no direct confidentiality or availability impact.

These ratings help security teams assess the issue, but they do not remove the need to evaluate how affected systems are deployed within an organisation.

Which Cisco products are affected?

Cisco states that the vulnerability affects Cisco Unified CM and Unified CM SME regardless of device configuration, as described at the time of publication.

The advisory provides the following fixed-release guidance:

Cisco notes that the fix is also included in its broader October 2026 Cisco Unified Communications Products Security Hardening Release. Administrators should consult the official advisory and the relevant bug details to confirm the appropriate fixed version for their environment.

Why the vulnerability matters

Access control determines which resources a user or request can reach. When a system incorrectly validates requests, an attacker may be able to cross boundaries that should restrict access.

In this case, Cisco specifically warns that successful exploitation could provide access to parts of the network beyond the attacker's intended scope. The advisory does not state that the flaw automatically provides administrative control, exposes all communications data or causes a service outage. Those outcomes should not be assumed.

For IT and security teams, the practical concern is whether the organisation operates an affected release and whether the relevant update has been installed.

Exploitation status: Cisco's Product Security Incident Response Team (PSIRT) reported that it was not aware of public announcements or malicious use of this vulnerability at the time of publication. This is a statement about Cisco's awareness, not proof that exploitation is impossible.

How administrators should respond

Cisco recommends upgrading to the fixed software release identified in its advisory. Since no workaround is available, installing the appropriate update is the primary remediation described by the company.

Recommended administrative steps include:

1. Identify affected deployments. Check whether your organisation runs Cisco Unified CM or Unified CM SME.

2. Verify the installed release. Compare the current version with Cisco's fixed-release guidance and consult the detailed release notes where necessary.

3. Plan the upgrade. Confirm that the target release is supported by the deployed hardware and software configuration.

4. Apply the security update. Follow Cisco's upgrade guidance and the organisation's change-management procedures.

5. Verify remediation. Confirm that the system is running the intended fixed release and retain evidence of the change.

The compatibility and upgrade checks are particularly important for production communications systems. Cisco advises administrators to confirm available memory and ongoing hardware and software support when considering an upgrade. Organisations that cannot obtain an entitled software update through their usual channel can consult Cisco's Technical Assistance Center (TAC) guidance.

What security teams should take away

This advisory reinforces a practical lesson for enterprise infrastructure management: security patching must account for access control weaknesses as well as more widely recognised issues such as remote code execution.

Organisations should prioritise accurate asset inventories, version tracking and a clear process for deploying vendor security updates. Teams should also distinguish between a vendor-confirmed vulnerability and evidence of exploitation in the wild.

Cisco's advisory confirms the vulnerability, the affected product families, the available fixed releases and the absence of a workaround. It does not disclose a confirmed exploitation campaign or evidence that affected customer environments have been compromised.

For organisations operating these communications platforms, the immediate task is to establish exposure and apply the appropriate fixed release.

Official advisory and further information

Read the original notice from Cisco for the latest affected-release information and remediation guidance:

• Cisco Unified Communications Manager Improper Access Control Vulnerability

• Cisco Security Advisory: CVE-2026-76487