CVE-2026-76487: Exposed Dangerous Method or Function in Cisco Cisco Unified Communications Manager

This vulnerability in Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition arises from improper input validation of certain HTTP requests. An unauthenticated remote attacker can exploit this flaw by sending specially crafted HTTP requests to bypass access controls on the affected device. Successful exploitation could grant unauthorized access to network segments beyond the attacker's normal permissions. The CVSS 3.1 base score is 5.3, indicating medium severity, with no confidentiality or availability impact but limited integrity impact. The affected versions include multiple specific releases of Cisco Unified Communications Manager 14 and 15 series.

An unauthenticated remote attacker can bypass access controls on affected Cisco Unified Communications Manager devices, potentially gaining unauthorized access to restricted network areas. The impact is limited to integrity as per the CVSS vector, with no direct confidentiality or availability impact reported. This could lead to unauthorized actions within the system or network segments that should be protected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Cisco's advisories for updates. Until a fix is available, consider restricting network access to the management interfaces and implementing compensating controls to limit exposure to untrusted networks.