CVE-2026-76474: Improper Authentication in Cisco Cisco Emergency Responder

Cisco Emergency Responder versions 14, 14SU1, 14SU2, 14SU3, 14SU3a, 15, 15SU1, 15SU1a, 14SU4, 15SU2, 15SU3, 14SU5, 15SU4, 14SU6, 14SU4a, 15.0.1.13010-1 through 15.0.1.13017-1, 15SU3a, 15SU4a, and 14SU2a are affected by CVE-2026-76474, an improper authentication vulnerability classified under CWE-287. This vulnerability was discovered during Cisco's internal security review of multiple Unified Communications products. It has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability. Cisco has released software hardening updates to address this and other vulnerabilities.

Successful exploitation of this vulnerability could allow unauthenticated attackers to bypass authentication controls, potentially leading to unauthorized access to sensitive systems and data, complete compromise of the affected system, and disruption of service. The CVSS score of 9.8 reflects critical impact on confidentiality, integrity, and availability.

Cisco has conducted an internal security review and released software hardening updates that address this vulnerability. Users should apply the official Cisco updates corresponding to their affected versions to remediate this issue. Since this is not a cloud service, remediation requires updating the affected software versions. Patch status is confirmed by Cisco's advisory indicating fixes are available.