Cisco Unified CM CVE-2026-76475

Exploitation requires an attacker to inject script into a web page generated by the affected Cisco product's web interface (CWE-79, improper neutralization of input during web page generation) AND to induce a victim with an active authenticated session to render that malicious content - the CVSS UI:R confirms victim interaction (e.g., clicking a crafted link or loading attacker-supplied input) is mandatory, so this cannot be exploited fully autonomously. No attacker authentication is needed to deliver the payload (PR:N), and the attack is network-reachable (AV:N) with low complexity (AC:L). The primary limiting factors are the required user interaction and the fact that meaningful impact depends on targeting a privileged/administrative user of the voice interface; exploitation value drops sharply against low-privilege or non-interactive targets. The input does not state whether the XSS is reflected or stored, which affects delivery reliability - verify against the Cisco advisory.

This is a genuine high-priority issue but not an emergency-patch scenario based on available signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, 9.3 Critical) indicates a network-reachable, low-complexity, unauthenticated cross-site scripting flaw (CWE-79) whose elevated score is driven primarily by the scope change (S:C) - the injected script executes in the victim's authenticated browser context rather than being confined to the vulnerable component. The required user interaction (UI:R) is a meaningful limiting factor: an attacker cannot trigger this autonomously and must lure a victim (typically an administrator or privileged user of these Cisco voice/collaboration web interfaces) into clicking a crafted link or viewing attacker-controlled content. Critically, the mitigating signals point AWAY from urgent widespread risk: these were INTERNALLY discovered by Cisco engineering during a proactive hardening review, EPSS exploitation probability is not provided in the input, there is no CISA KEV listing, and no public exploit (POC) is identified - so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision data provided. One data inconsistency to verify: the published CVSS marks C:H/I:H, which is high for a reflected/stored XSS; for an admin-facing interface this is defensible via session hijacking, but C:H/I:H against a voice appliance XSS should be validated against the actual Cisco advisory. Net: patch on a normal-to-expedited cycle given the Critical score and admin exposure, but the absence of active-exploitation and POC signals means this is not a drop-everything event.

An attacker crafts a malicious URL or input payload containing JavaScript targeting the web-based administration interface of an affected Cisco collaboration product (e.g., Unified CM or Unity Connection) and sends it to a logged-in administrator via phishing. When the victim's browser renders the unsanitized page, the script executes in their authenticated session, allowing the attacker to steal session tokens or perform actions as that user (scope-changed impact, S:C). No public exploit code has been identified at time of analysis; the flaw was internally discovered by Cisco.