Vulnerability in Cisco Emergency Responder
CVE-2026-76473
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76473 are related to issues concerning improper control of a resource through its lifetime that are grouped under the Common Weakness Enumeration (CWE) Class CWE-74.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Cisco Emergency Responder — versions 14, 14SU1, 14SU2
- Cisco Unified Communications Manager — versions 14, 14SU1, 14SU2
- Cisco Unified Communications Manager Im And Presence Service — versions 14, 14SU1, 14SU2
- Cisco Unity Connection — versions 14, 14SU1, 14SU2
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-76473?
- CVE-2026-76473 is a critical-severity vulnerability in Cisco Emergency Responder, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 9.8/10. Published 2026-10-21.
- How severe is CVE-2026-76473?
- Critical severity. CVSS v3 base score is 9.8 out of 10.