Cisco Unified CM: access control bypass (CVE-2026-76487) and hardening fixes, fixed in 15SU5
CVE-2026-76473 CVE-2026-76474 CVE-2026-76475 CVE-2026-76476 CVE-2026-76477 CVE-2026-76478 CVE-2026-76479 CVE-2026-76481 CVE-2026-76487
Published 02/11/2026 02:10
Timeline
2 events over 11 d
- 21/10/2026 18:00ConfirmedCisco Security Advisories+11 d
- 02/11/2026 02:10Published on WatchtowerPro CISO
In short
Cisco has fixed an access control bypass in Unified CM and Unified CM SME that an attacker can trigger remotely without logging in (CVE-2026-76487, Medium). Cisco also released a hardening update for several Unified Communications products covering eight more CVEs, rated up to Critical. Cisco says there is no workaround and names 15SU5 as the first fixed release; it knows of no attacks.
How bad is it
Medium. An attacker on the network, without logging in, can bypass access controls on an affected Cisco phone system server and reach parts of the network beyond their intended access.
Confirmed by the vendor or a CERT - no exploitation reported yet.
Severity score
The worst of 9 CVEs · CVSS 3.1 from NVD, from cisco.com, read 02/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickNo
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Read the data it holds
- Change or delete that data
- Take it offline
Type: access control bypass.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- Unified CM and Unified CM SME are affected by the access control bypass, regardless of device configuration, at the time of publication.
- The hardening advisory affects Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME and Unity Connection, regardless of configuration.
Fixed in
- 14: no fix
What to do now
- Upgrade Unified CM, Unified CM SME, Unified CM IM&P, Emergency Responder, Prime Collaboration Deployment and Unity Connection to release 15SU5, the first fixed release named by Cisco.
- If you run branch 14, migrate to a fixed release (15SU5), because Cisco names no fixed 14 release.
- Cisco offers no workaround or interim measure, so upgrading is the only fix. The access control fix is also part of the hardening release, so 15SU5 covers both advisories.
- Check the Cisco bug ID details (CSCwv00936) for the most current list of affected releases.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 5 open questions, followed up as sources answer and all 4 sources with their dates. And technology matching: which of your systems run Cisco Unified Communications Manager and Unified CM SME, at which version, fixed or not - and what each one needs.
Main sources
Cisco Unified Communications Manager Improper Access Control Vulnerability Vendor · Cisco Unified Communications Products Security Hardening Release: October 2026 Vendor · Cisco Security Advisory: Cisco Unified Communications Manager Improper Access Control Vulnerability Research