Cisco Unified CM CVE-2026-76478

Requires an attacker to already possess a low-privileged authenticated account or local session on the affected Cisco Unified Communications appliance (AV:L + PR:L); there is no remote, unauthenticated, network-facing exploitation path in the scored vector. The description bundles multiple internally discovered access-control weaknesses and names no specific feature, configuration flag, or deployment mode as a precondition, so exploitation appears to apply to default configurations once local authenticated access is held. Limiting factors that reduce real-world risk: the mandatory local access vector, the required valid low-privilege credentials, and the absence of any public exploit or active-exploitation evidence.

This is a medium-priority issue rather than an emergency, despite the 8.8 'High' CVSS score. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) is the strongest signal: it is a LOCAL vector requiring LOW privileges (PR:L), meaning an attacker must already hold an authenticated, low-privileged foothold on the appliance - not a remotely reachable, unauthenticated flaw. The 8.8 score is inflated by Scope:Changed combined with triple-High impact (classic privilege-escalation/access-control pattern), not by ease of initial access. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The 'Authentication Bypass' tag sits in tension with the CVSS vector: a true pre-auth bypass would normally be PR:N, whereas this is PR:L (post-authentication), so the vulnerability is more consistent with improper access control / privilege escalation (CWE-284) than a clean unauthenticated bypass - treat the tag as approximate and verify against the Cisco advisory. These were internally discovered by Cisco during a proactive hardening review, which further reduces (though does not eliminate) the likelihood of in-the-wild exploitation.

An attacker who has already obtained a low-privileged authenticated account or local session on a Cisco Unified CM / Unity Connection / Emergency Responder node abuses an improper access-control check to act outside their intended authorization boundary. Because scope is changed with full CIA impact, this allows escalation to administrative control over the collaboration platform and its data. No public exploit code is known, and the local vector plus required authentication meaningfully limit opportunistic mass exploitation.