Threat Intelligence Database

CVE-2026-76479 is a high-severity vulnerability in Cisco Emergency Responder involving improper limitation of a pathname to a restricted directory, commonly known as a path traversal flaw. This vulnerability allows an attacker with limited privileges to potentially access or modify files outside intended directories. It affects multiple specific versions of Cisco Emergency Responder. The vulnerability was identified during Cisco's internal security review and is part of a broader set of hardening efforts across several Cisco collaboration products. The CVSS 3.1 base score is 7.8, indicating high impact on confidentiality, integrity, and availability. No public exploits are known at this time, and the product is not a cloud service. Patch or remediation status is not explicitly stated in the provided data.

CVE-2026-76478 is a high-severity vulnerability in Cisco Emergency Responder involving improper access control. It affects multiple specific versions of the product and has a CVSS 3.1 score of 8.8, indicating critical confidentiality, integrity, and availability impacts. The issue was identified during Cisco's internal security review and addressed through software hardening releases. No public exploits are currently known. The vulnerability requires local access with low privileges and no user interaction is needed for exploitation.

CVE-2026-76475 is a critical cross-site scripting (XSS) vulnerability in Cisco Emergency Responder. It involves improper neutralization of input during web page generation, allowing potential injection of malicious scripts. The vulnerability affects multiple specific versions of Cisco Emergency Responder. The CVSS score is 9.3, indicating high impact on confidentiality and integrity with no privileges required but user interaction needed. No known exploits are reported in the wild. Cisco has performed internal security reviews and released software hardening updates addressing this and other vulnerabilities.