EUVD-2026-81161
GHSA-mw9j-8jg3-ch52
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-reachable web UI (AV:N/AC:L), requires a valid low-privilege account (PR:L), no user interaction; missing authorization yields configuration tampering (I:H) with no stated confidentiality or availability impact (C:N/A:N), scope unchanged.
Primary rating from Vendor (cisco).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker with low privileges to alter configurations on an affected device.
This vulnerability is due to missing authorization checks. An attacker could exploit this vulnerability by sending a crafted HTTP request. A successful exploit could allow the attacker to alter configurations on select pages.
AnalysisAI
Missing per-role authorization checks in the CommPilot web-based management interface of Cisco BroadWorks allow an authenticated, low-privilege remote user to alter configurations on select administrative pages via a crafted HTTP request. The issue (CVE-2026-76438, CWE-863, CVSS 6.5 / CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) affects BroadWorks releases 21.0 through 26.0, including the 21.sp1 line and assorted RI builds, with the assessed impact limited to configuration integrity - no confidentiality or availability loss per the vector. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid, authenticated low-privilege account on the Cisco BroadWorks CommPilot Application Software web-based management interface; the attacker then sends a crafted HTTP request to an endpoint whose per-role authorization check is missing, allowing configuration changes on select pages. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-severity, authenticated integrity-only issue that should be treated as a routine patch priority rather than an emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The available data does not include an exact fixed version string, so patch status is 'fixed software published through the Cisco advisory, specific version not independently confirmed here' - administrators should open Cisco Security Advisory cisco-sa-auth-bypass-broadwor-57m9dmm5 (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-auth-bypass-broadwor-57m9dmm5) and upgrade each affected BroadWorks/CommPilot system to the maintenance ('ap') build Cisco lists for its release train, applying the fix to 21.0, 21.sp1, 22.0, 23.0, 24.0, 25.0 and 26.0 deployments alike, since the vulnerability spans all of them. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cisco Broadworks
View allSame weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today