Cisco Unified CM CVE-2026-76473

The advisory provides no concrete prerequisites - it is a batched hardening release describing CWE-74 (injection) issues without naming the specific feature, protocol, parameter, or configuration involved, so the exact triggering condition CANNOT be extracted from available data. The vendor vector (AV:N/AC:L/PR:N/UI:N) implies remote unauthenticated exploitation against the affected Cisco collaboration appliances' network-exposed interfaces with no special configuration or user interaction required; however, because the description is generic, this cannot be confirmed, and real-world exposure is limited by whether the management/application interfaces of Unified CM, Unity Connection, Emergency Responder, or IM&P are reachable from the attacker's network segment. Limiting factors: these are typically internal enterprise voice appliances rather than internet-facing, narrowing the practical attack surface to adjacent-network or intranet positions in most deployments.

The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a maximally exploitable flaw: network-reachable, low complexity, no privileges, no user interaction, with total loss of confidentiality, integrity, and availability - consistent with the CWE-74 injection class. However, the real-world risk signals temper this: no EPSS score was provided, the vulnerability is NOT in CISA KEV, and no public proof-of-concept is referenced, so exploitation status is 'no public exploit identified at time of analysis.' Critically, this CVE originates from Cisco's own proactive internal security review and hardening release, not from external exploitation or disclosure, which historically correlates with lower immediate in-the-wild activity than externally reported Cisco appliance bugs. The description is a generic batch advisory covering multiple internally discovered issues grouped under one ID and provides NO technical detail on the actual injection vector, affected component, or preconditions - so the 9.8 rating cannot be independently corroborated from the text. Net assessment: patch on a priority schedule because the products are high-value internet-or-intranet-exposed collaboration infrastructure and the CVSS is critical, but there is no current evidence of active or widespread exploitation, so this is urgent-to-patch rather than emergency-firefight.

A remote, unauthenticated attacker with network reach to a Cisco Unified CM, Unity Connection, Emergency Responder, or IM&P web/management interface sends a crafted request that injects attacker-controlled data into a resource the application processes unsafely (CWE-74), per the AV:N/AC:L/PR:N/UI:N vector. Successful injection yields full confidentiality, integrity, and availability impact on the affected appliance. No public exploit code is currently identified, and the advisory provides no component-level detail, so the precise injection surface is unverified.