CVE-2026-76473: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in Cisco Cisco Emergency Responder

CVE-2026-76473 concerns an injection vulnerability in Cisco Emergency Responder caused by improper neutralization of special elements in output used by downstream components. This flaw is linked to improper control of resource lifetime (CWE-74). The vulnerability affects numerous specific versions of Cisco Emergency Responder (including =14, =15, and various service updates). Cisco's engineering teams identified this issue during a comprehensive internal security review and have issued software hardening releases to mitigate it. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute injection attacks that compromise confidentiality, integrity, and availability of the affected Cisco Emergency Responder systems. Given the critical CVSS score of 9.8, the impact is severe, potentially enabling full system compromise or disruption of emergency response communications.

Cisco has released software hardening updates addressing this vulnerability as part of their internal security review process. Users should apply the official patches or updates provided by Cisco for the affected versions of Cisco Emergency Responder. Since this is not a cloud service, remediation requires customer action to update affected software. Patch status is not explicitly confirmed in the provided data; users should consult Cisco advisories for the latest remediation guidance.