Improper input validation in Cisco Emergency Responder
CVE-2026-76476
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76476 are related to issues concerning improper input validation that are grouped under the Common Weakness Enumeration (CWE) Class CWE-20.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Cisco Emergency Responder — versions 14, 14SU1, 14SU2
- Cisco Unified Communications Manager — versions 14, 14SU1, 14SU2
- Cisco Unified Communications Manager Im And Presence Service — versions 14, 14SU1, 14SU2
- Cisco Unity Connection — versions 14, 14SU1, 14SU2
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-76476?
- CVE-2026-76476 is a high-severity vulnerability in Cisco Emergency Responder, classified under Improper Input Validation. CVSS score: 8.8/10. Published 2026-10-21.
- How severe is CVE-2026-76476?
- High severity. CVSS v3 base score is 8.8 out of 10.