/
← Voltar ao feed
medium

Cisco Unified CM and Unified CM SME improper access control flaw (CVE-2026-76487) allows unauthenticated remote bypass

1 fonte(s) · 1 atualização(ões) · publicado 21/10/2026 13:00 · coletado há 1 dia

Baseado só no resumo do feed. O site da fonte não liberou o texto completo para o Tifon, então esta análise saiu apenas do resumo publicado no feed e pode estar incompleta. Ela é atualizada quando outra fonte cobrir o assunto. Ler na fonte original ↗

Cisco disclosed CVE-2026-76487, an improper access control vulnerability in Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (Unified CM SME). An unauthenticated, remote attacker could send a crafted HTTP request to an affected device and bypass access controls. A successful exploit could give the attacker access to parts of the network beyond their intended scope. Cisco rates the Security Impact as Medium, has released software updates, and states there are no workarounds. The article does not report active exploitation. The advisory is part of Cisco's October 21, 2026 advance-notification bundle.

Detalhes técnicos

  • Root cause: improper input validation for specific HTTP requests.
  • Attack vector: network-based, unauthenticated, via a crafted HTTP request.
  • Impact: access control bypass, with access to resources outside the attacker's intended scope.
  • Advisory ID: cisco-sa-cucm-access-PW9e8Jt2.

Remediação

  • Apply the Cisco software updates that fix this vulnerability. No workarounds exist.
  • See the Cisco Unified Communications Products Security Hardening Release: October 2026 for related improvements and fixes.

Linha do tempo

  1. sec.cloudapps.cisco.com ↗ · pub. 21/10/2026 13:00 · coletado 21/10 14:00 primeiro registro só resumo do feed

    Cisco Unified CM and Unified CM SME improper access control flaw (CVE-2026-76487) allows unauthenticated remote bypass

    ler a análise desta fonte

    Cisco disclosed CVE-2026-76487, an improper access control vulnerability in Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (Unified CM SME). An unauthenticated, remote attacker could send a crafted HTTP request to an affected device and bypass access controls. A successful exploit could give the attacker access to parts of the network beyond their intended scope. Cisco rates the Security Impact as Medium, has released software updates, and states there are no workarounds. The article does not report active exploitation. The advisory is part of Cisco's October 21, 2026 advance-notification bundle.

    Technical Details

    • Root cause: improper input validation for specific HTTP requests.
    • Attack vector: network-based, unauthenticated, via a crafted HTTP request.
    • Impact: access control bypass, with access to resources outside the attacker's intended scope.
    • Advisory ID: cisco-sa-cucm-access-PW9e8Jt2.

    Remediation

    • Apply the Cisco software updates that fix this vulnerability. No workarounds exist.
    • See the Cisco Unified Communications Products Security Hardening Release: October 2026 for related improvements and fixes.