Cisco Unified CM CVE-2026-76474

The advisory groups multiple internally discovered improper-authentication (CWE-287) issues and does not name a specific feature, protocol, or non-default setting as a prerequisite; combined with the CVSS vector (AV:N/AC:L/PR:N/UI:N) this implies remote, unauthenticated exploitation reachable over the network against affected Cisco collaboration products (Cisco Emergency Responder, Unified CM, Unified CM IM&P, Unity Connection, and per the description also Prime Collaboration Deployment and Unified CM SME). The primary limiting factor is network exposure: these are enterprise telephony/collaboration servers normally reachable only from internal or management networks rather than the public internet, so realistic exploitation requires the attacker to have a foothold on, or routed access to, the network segment hosting the administrative/web services. Specific affected versions and whether any particular configuration mode is required could not be determined from the provided data and should be verified against the Cisco advisory.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8 Critical) describes a remotely exploitable improper-authentication flaw (CWE-287) requiring no privileges, no user interaction and low complexity, with full confidentiality/integrity/availability impact - the classic signature of a pre-authentication bypass. However, the signals are thin and partly conflicting: the Cisco advisory describes this as a batch of INTERNALLY discovered vulnerabilities found during a proactive security review and bundled into hardening releases, which typically means no external discovery pressure and no observed attacker activity. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so exploitation probability cannot be quantified and there is no public exploit identified at time of analysis. The high CVSS therefore reflects theoretical impact rather than demonstrated real-world exploitation. Net: this is a legitimately high-priority patch target because the affected products are internet- and internal-network-reachable collaboration servers and the flaw is pre-auth, but it is NOT (on the available evidence) an actively exploited emergency - treat it as 'patch promptly' rather than 'exploited in the wild.' Key missing data: per-vulnerability detail (this CVE groups multiple issues), EPSS, and any independent confirmation of exploitability.

An unauthenticated attacker with network reachability to an exposed Cisco Unified CM, Unity Connection, IM&P, or Emergency Responder administrative/web interface sends crafted requests that bypass the authentication layer, gaining unauthorized access to privileged functionality or data. Given AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special timing are required. No public exploit code is identified at time of analysis; the issue was internally discovered by Cisco.