CVE-2026-76487CWE-749

CVE-2026-76487

Medium · published October 21, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
42.0
In the wild
Unconfirmed
What it is

A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct access control bypass attacks on an affected device.

This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to access parts of the network that are beyond the scope of their intended access.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00501 · 42.0th percentile
Weakness
CWE-749 · Exposed Dangerous Method or Function
Published
2026-10-21T21:19Z
References (1)
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-access-PW9e8Jt2 · [email protected]
EPSS history
Timeline
  • 23 OCT 04:07Z
    EPSS moved — → 1%
    epss
  • 21 OCT 16:16Z
    Cisco Unified Communications Manager Improper Access Control Vulnerability
    cvelistv5
  • 21 OCT 16:16Z
    Cisco Unified Communications Manager Improper Access Control Vulnerability
    cvelistv5