Cisco Unified CM CVE-2026-76479

Exploitation requires local access to an affected Cisco collaboration appliance (Emergency Responder, Unified CM / IM&P / SME, Unity Connection, or Prime Collaboration Deployment) AND valid low-privilege authentication (CVSS PR:L), with no user interaction needed. The flaw is an improper limitation of a pathname to a restricted directory (CWE-22), so the concrete prerequisite is the ability to supply a file path parameter to an affected component as an authenticated user. Limiting factors that reduce real-world risk: the local attack vector (AV:L) means no direct network exploitation, and the authentication requirement means an attacker must already hold credentials or local access on the appliance; this is a defense-in-depth hardening fix from an internal Cisco review rather than a response to observed exploitation.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) is internally consistent and describes a locally-exploitable path traversal (CWE-22) requiring an already-authenticated low-privileged user - not a remote unauthenticated attack. This materially lowers real-world urgency versus the raw 7.8: the attacker must already have valid (low-privilege) credentials or shell/CLI access to one of the affected Cisco collaboration appliances. No EPSS score was supplied, so exploitation probability cannot be quantified. KEV status is not indicated in the input and no CISA KEV flag is present, so there is no evidence of active exploitation. No POC is referenced. SSVC inputs (exploitation status, automatable, technical impact) were not provided, but by inference technical impact is total (C:H/I:H/A:H) while automatability is low given the local vector and auth requirement. These vulnerabilities were internally discovered by Cisco's own engineering review rather than reported from field exploitation, which further suggests this is a proactive hardening fix rather than a response to observed attacks. Net: a genuinely high technical-impact flaw but with a constrained (local + authenticated) attack surface - prioritize patching on internet-adjacent or multi-tenant collaboration infrastructure, but it is not a drop-everything remote RCE.

A low-privileged authenticated user on a Cisco Unified CM, Emergency Responder, Unity Connection, or IM&P appliance abuses a path-traversal flaw to read or write files outside the intended restricted directory, reaching sensitive configuration or system files. Because the CVSS impact is C:H/I:H/A:H, successful traversal can disclose credentials/config, tamper with files, and disrupt the service. No public exploit code is identified at time of analysis, and the local attack vector means the attacker must first obtain valid low-level access to the box.