Auth bypass in Cisco Broadworks
CVE-2026-76438
A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker with low privileges to alter configurations on an affected device. This vulnerability is due to missing authorization checks. An attacker could exploit this vulnerability by sending a crafted HTTP request. A successful exploit could allow the attacker to alter configurations on select pages.
Vulnerability class: Broken Access Control
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Cisco Broadworks — versions 21.0, 21.0 ap205814, 21.0 ap215990
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-76438?
- CVE-2026-76438 is a medium-severity vulnerability in Cisco Broadworks, classified under Incorrect Authorization. CVSS score: 6.5/10. Published 2026-09-16.
- How severe is CVE-2026-76438?
- Medium severity. CVSS v3 base score is 6.5 out of 10.