Cisco Unified CM CVE-2026-76477

Exploitation requires valid authenticated access to a web/administrative interface of an affected Cisco collaboration product (PR:L confirms low-but-nonzero privileges are needed), so it cannot be performed by a fully unauthenticated attacker. No user interaction or non-default configuration is indicated - any deployment of Cisco Emergency Responder, Unified Communications Manager, Unified CM IM&P, Unified CM SME, or Unity Connection running an unpatched version is affected once the attacker has a low-privilege account. The main limiting factor is the credential requirement and the fact that these management interfaces are typically on internal or restricted networks rather than internet-facing.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8 High) indicates a network-reachable, low-complexity SQL injection requiring only low-level authenticated privileges and no user interaction, yielding high confidentiality, integrity, and availability impact - a serious combination for internet- or intranet-exposed collaboration infrastructure. However, the mitigating signals are strong: the flaw was internally discovered by Cisco engineering during a proactive hardening review, there is no CISA KEV listing, no public proof-of-concept, and no EPSS probability was supplied in the input. There is no evidence of exploitation; this is an internally found, pre-emptively patched issue rather than an actively attacked one, so it should be prioritized as standard-urgency patching (authenticated access is still required) rather than emergency response. Note the one data gap worth verifying: EPSS is absent, so exploitation likelihood cannot be quantified - however, given these products are rarely exposed directly to the internet and exploitation requires valid credentials, real-world risk is meaningfully lower than the 8.8 score alone suggests.

An attacker who already holds low-privilege authenticated credentials to a Cisco Unified CM, Unity Connection, Emergency Responder, or IM&P web interface submits crafted input to a parameter that is improperly neutralized before being used in an SQL command. Because attack complexity is low and no user interaction is needed, the attacker can read, modify, or destroy backend database contents in a single authenticated session. No public exploit code has been identified at time of analysis.