CVE-2026-76477: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Cisco Cisco Emergency Responder

CVE-2026-76477 concerns an SQL injection vulnerability in Cisco Emergency Responder caused by improper neutralization of special elements in SQL commands (CWE-89). This vulnerability was discovered during Cisco's internal security review of several collaboration products, leading to software hardening releases. The flaw allows an attacker with low privileges to execute unauthorized SQL commands, potentially compromising the system's confidentiality, integrity, and availability. The affected versions include a detailed list of specific releases from version 14 through 15SU4a and several patch-level builds. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker with low privileges to perform SQL injection attacks, leading to unauthorized access to or modification of sensitive data, disruption of service, or other impacts on system integrity and availability. The high CVSS score (8.8) reflects the critical nature of these impacts.

The input data does not include explicit patch or remediation information. Patch status is not yet confirmed — check the Cisco vendor advisory for current remediation guidance. Given the vulnerability was identified during an internal review and software hardening releases were mentioned, it is likely that patches or updates are available or forthcoming. Users should monitor Cisco advisories and apply updates as soon as they are released.