Cisco Unified CM CVE-2026-76476

Exploitation requires the attacker to hold valid low-privilege credentials on an affected Cisco Unified Communications product (Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, or Unity Connection) per PR:L, and network reachability to the vulnerable web/API interface per AV:N. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The advisory does not specify a non-default feature or configuration prerequisite; the primary limiting factors are the need for prior authentication at a low privilege level and network access to the management/application interface, so deployments that restrict UC administrative/application interfaces to trusted networks and tightly control low-privilege accounts substantially reduce exposure.

The input CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8 HIGH) describes a network-reachable, low-complexity flaw requiring only low-privilege authentication (PR:L) and no user interaction, with full confidentiality, integrity, and availability impact. No EPSS score, CISA KEV entry, POC reference, or SSVC decision data was supplied; per the available signals this is 'no public exploit identified at time of analysis' and NOT confirmed actively exploited. The vulnerability was internally discovered by Cisco's own engineering during a proactive hardening review rather than reported from observed in-the-wild activity, which lowers near-term mass-exploitation likelihood. Note a conflict worth flagging: the input Tags label this 'Information Disclosure,' but the CVSS vector asserts C:H/I:H/A:H (full compromise), so the impact is broader than disclosure alone - treat the tag as under-stating impact and defer to the CVSS vector. Because exploitation requires valid (if low-privilege) credentials, real-world risk is meaningful on internet-exposed or multi-tenant UC deployments but is gated by authentication; prioritize patching given the high impact and widely deployed product family, while recognizing exploitation probability is currently unquantified (EPSS missing).

An authenticated attacker with low-privilege access to a Cisco Unified Communications web/API interface (e.g., a basic application account) submits crafted input that the application fails to validate (CWE-20), abusing the improper validation to read sensitive data, alter data, or disrupt the service. No user interaction is required and the attack is performed over the network. No public proof-of-concept or exploit code is identified in the provided data.