Cisco Unified CM Vulnerability Enables Unauthenticated Lateral Movement, Urging Immediate Patching
Unauthenticated attackers can bypass access controls in Cisco Unified CM via improper input validation, risking lateral movement across enterprise networks.
Key points
- Cisco released updates for CVE-2026-76487 affecting Unified CM and SME.
- The flaw allows unauthenticated remote access control bypass via HTTP requests.
- No workarounds are available; software updates are required for remediation.
Cisco has released software updates to address a medium-severity vulnerability in its Unified Communications Manager that could allow attackers to bypass access controls without authentication. This flaw, tracked as CVE-2026-76487, stems from improper input validation in specific HTTP requests sent to affected devices.
The risk
An unauthenticated remote attacker could exploit this vulnerability by sending crafted HTTP requests to an affected Cisco Unified CM or Unified CM Session Management Edition device. A successful exploit allows the attacker to access parts of the network that are beyond the scope of their intended access, potentially facilitating lateral movement within an organization's infrastructure.
Who is exposed
The vulnerability affects Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition regardless of device configuration at the time of publication. Cisco PSIRT is not aware of any public announcements or malicious use of this vulnerability, but the potential for unauthorized network access remains a significant concern for administrators.
Cost and compliance
The Common Vulnerability Scoring System base score for CVE-2026-76487 is 5.3. While the advisory rates the security impact as medium, the ability to bypass access controls without credentials poses operational risks. Organizations must weigh the disruption of applying updates against the potential costs of unauthorized network access and data exposure.
What happens next
Cisco strongly recommends that customers upgrade to the fixed software releases indicated in the advisory to remediate this vulnerability. There are no workarounds available to mitigate the risk until the software update is applied. Administrators should verify which releases are vulnerable and plan immediate deployment of the patches.
Questions to ask your suppliers
Organizations should ask their managed service providers whether they have identified all instances of affected Cisco Unified CM versions in their managed environments. IT leadership needs to confirm that patching schedules prioritize critical communication infrastructure to minimize exposure windows. Security teams should verify that change management processes allow for rapid deployment of urgent security updates without delaying business operations.
What to do and how to stay safe: Cisco
- Inventory all Cisco Unified CM and SME devices to determine if they run vulnerable software versions.
- Schedule immediate deployment of Cisco’s released software updates to remediate the access control bypass.
- Monitor network traffic for unusual HTTP requests to Unified CM devices as an interim detection measure.
- Review access logs for signs of unauthorized network access attempts during the exposure window.
Step-by-step guide: Vulnerability Prioritization: Fix What Actually Breaks Your Business
General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is there a workaround for CVE-2026-76487?
No, Cisco states that there are no workarounds available for this vulnerability.
What is the CVSS score for this flaw?
The base CVSS score for CVE-2026-76487 is 5.3.
Has this vulnerability been exploited in the wild?
Cisco PSIRT is not aware of any public announcements or malicious use of this vulnerability.
