CVE-2026-76479: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Cisco Cisco Emergency Responder

CVE-2026-76479 concerns a path traversal vulnerability in Cisco Emergency Responder, where the software improperly limits pathnames to restricted directories. This flaw could allow an attacker with local privileges to access or manipulate files outside the intended directory boundaries, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability was discovered during an internal security review by Cisco engineering teams and is part of multiple vulnerabilities addressed in software hardening releases. The affected versions include numerous specific releases of Cisco Emergency Responder, ranging from version 14 through various service updates and sub-versions up to 15SU4a and specific builds of 15.0.1.x. The CVSS 3.1 vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. There is no indication of known exploits in the wild or cloud service involvement.

Successful exploitation of this vulnerability could allow an attacker with local privileges to perform unauthorized file access or modification outside of restricted directories, potentially leading to full compromise of the system's confidentiality, integrity, and availability. The high CVSS score reflects the severity of these impacts. However, no known exploits are currently reported in the wild.

The provided data does not include explicit information about patch availability or remediation from Cisco. Since this is not a cloud service, remediation would typically require applying vendor-supplied patches or updates. Patch status is not yet confirmed—check the official Cisco advisory for current remediation guidance. Until patches are applied, restrict local access to trusted users only and monitor for suspicious activity related to file access.