CVE-2026-76478: Improper Access Control in Cisco Cisco Emergency Responder

CVE-2026-76478 concerns improper access control vulnerabilities in Cisco Emergency Responder. These issues were discovered internally by Cisco engineering teams as part of a comprehensive security review across several Cisco Unified Communications products. The vulnerability is categorized under CWE-284 (Improper Access Control). It affects numerous specific versions of Cisco Emergency Responder, including versions 14, 15, and various service updates and patches enumerated explicitly. The CVSS 3.1 base score is 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting local attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Cisco has released software hardening updates to address these vulnerabilities, though explicit patch links or advisories were not provided in the input data.

Successful exploitation of this vulnerability could allow an attacker with low privileges and local access to bypass access controls, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. This could result in unauthorized access to sensitive information, modification of data, or disruption of service within Cisco Emergency Responder environments.

Cisco has conducted internal security reviews and released software hardening updates to address the vulnerabilities related to CVE-2026-76478. Users should apply the official software updates corresponding to their affected versions as soon as possible. Since the product is not a cloud service, remediation requires updating the affected on-premises software. Patch status is not explicitly confirmed in the provided data; therefore, users should consult Cisco's official advisories for detailed patch availability and installation instructions.