EUVD-2026-107349
GHSA-wf3w-h74r-36x7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Cisco voice service over network
-
DeliverySend crafted malformed request
-
ExploitTrigger unhandled exceptional condition (CWE-703)
-
ExecutionService crash or hang
-
ImpactLoss of collaboration/emergency-call availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Exception handling framework
|
| Exploitation Conditions | Exploitation requires network reachability to an affected Cisco collaboration service - Cisco Emergency Responder, Unified Communications Manager, Unified CM IM & Presence Service, or Unity Connection - reachable over the network interface exposing the vulnerable function. Per the CVSS vector (PR:N/UI:N), no authentication and no user interaction are required, and no non-default configuration is indicated in the available data. The practical limiting factor is network exposure: these are typically internal/management-plane services, so impact is reduced where the affected nodes are not reachable from untrusted networks. The impact is limited to availability (service disruption/DoS); there is no data confidentiality or integrity consequence. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5 HIGH) describes a network-reachable, low-complexity, unauthenticated flaw with pure availability impact (C:N/I:N/A:H) and no scope change - consistent with a remotely triggerable denial-of-service in Cisco's voice/collaboration stack, matching the CWE-703 (improper handling of exceptional conditions) weakness class. No EPSS score was supplied, no CISA KEV listing is present, and no POC is indicated, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Signals are internally consistent (DoS-only CWE and A:H-only impact agree), but note a conflict in the metadata: the 'Information Disclosure' tag directly contradicts the CVSS vector's C:N/I:N - there is no confidentiality or integrity impact, so this is a service-disruption issue, not disclosure. Net assessment: a real but moderate-priority patch item - the network/unauthenticated reach warrants timely remediation on exposed collaboration infrastructure, but the availability-only impact and absence of exploitation signals (no KEV, no POC, no EPSS) place it below confidentiality/integrity-breaching criticals. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker with network reachability to an affected Cisco Unified CM, Unity Connection, Emergency Responder, or IM&P node sends crafted input that triggers the improperly handled exceptional condition, crashing or hanging the service. The result is disruption of enterprise voice, voicemail, presence, or emergency-calling availability. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Cisco voice and collaboration products - Unified Communications Manager, Unified CM IM & Presence, Emergency Responder and Unity Connection (with Prime Collaboration Deployment and Unified CM SME also named in the advisory) - contain a set of internally discovered flaws in the CWE-703 improper-handling-of-exceptional-conditions class that can be triggered over the network by an unauthenticated remote attacker with no user interaction, disrupting service availability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) rates this as a denial-of-service condition only, with no confidentiality or integrity impact. The issues were found during Cisco's own hardening review rather than through external reporting, and no public exploit has been identified at time of analysis; the realistic exposure depends on whether the affected collaboration nodes are reachable from untrusted networks, since these services normally sit on internal management planes.
RemediationAI
Cisco addressed these internally discovered defects through software hardening releases published in advisory cisco-sa-voice-hardening-twgbH9e3 (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3); the advisory does not expose exact fixed version numbers in the supplied data, so the authoritative fix is to look up each deployed product line - Unified CM, Unified CM IM & Presence, Emergency Responder, Unity Connection, Prime Collaboration Deployment and Unified CM SME - in that advisory's fixed-release tables and upgrade to the listed build or later, coordinating cluster-wide upgrades during a maintenance window because these are shared-services components. Until upgraded, the effective compensating control is exposure reduction: permit SIP, HTTPS management and other collaboration service ports only from trusted voice/management VLANs and jump hosts via ACLs or a voice-aware firewall in front of the cluster (trade-off: remote endpoints, gateways and third-party integrations outside those ranges lose connectivity), and avoid publishing these nodes to the internet or partner networks (trade-off: breaks any legitimately internet-facing telephony or remote-worker flows, which then need VPN or an SBC). Add SNMP/syslog alerting on unexpected process restarts or service outages on these nodes so that crash-based exploitation attempts are detected quickly, and rate-limit or deep-inspect traffic at the perimeter as a secondary measure, accepting that aggressive throttling can degrade legitimate signalling and management traffic. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, so patching cadence can follow normal change control, but the unauthenticated, low-complexity nature of the vector argues for prioritizing internet- or partner-reachable clusters.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The advisory groups several defects under the CWE-703 pillar, 'Improper Check or Handling of Exceptional Conditions' - a parent class covering unhandled exceptions, unchecked error returns and missing error-path handling. In practice this means a network-facing listener in the Cisco collaboration stack can receive crafted or malformed input that drives the code into an exception path it does not recover from, terminating or wedging the affected process. Because the vector carries PR:N and UI:N, no credentials or user action are needed, and AC:L indicates the attacker does not need to win a race or defeat significant mitigations; the single impact metric is A:H, so the outcome class is a remotely triggerable denial of service with no scope change and no read or write of protected data. CPE data maps the affected code base to cisco_emergency_responder, cisco_unified_communications_manager, cisco_unified_communications_manager_im_and_presence_service and cisco_unity_connection, while the advisory text additionally names Prime Collaboration Deployment and Unified CM Session Management Edition; version fields are wildcarded in the CPEs, so the exact vulnerable ranges must be read from the Cisco advisory. Note that the accompanying reference tagging mentions information disclosure, which is inconsistent with the assessed CVSS vector and is best treated as a bundle-level label for the multi-CVE hardening release rather than a description of this specific flaw.
Know when Cisco Emergency Responder gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable, low-complexity, unauthenticated per source vector; CWE-703 improper exception handling yields availability-only impact, so C:N/I:N/A:H and S:U.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76481 are related to issues concerning improper handling of exceptional conditions that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-703.
Executive ViewAI
Cisco Unified Communications Manager, Unified CM IM & Presence, Emergency Responder, Unity Connection, Prime Collaboration Deployment, and Unified CM SME are exposed to a high-severity unauthenticated network denial-of-service condition that can disrupt voice and collaboration availability without user interaction. Because these platforms often support critical communications and may be reachable from untrusted network segments, leadership should treat exposure review and network containment as an immediate operational resilience priority; no public exploit has been identified at time of analysis and no confidentiality or integrity impact is rated.
No vendor-released patch identified at time of analysis; interim mitigations include restricting access to affected Cisco collaboration nodes from untrusted networks, segmenting management planes, applying firewall and ACL controls, disabling unnecessary services and external exposure, monitoring service availability, and following Cisco TAC and advisory guidance until a fixed version is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Cisco Emergency Responder
View allAuthentication bypass in Cisco Unified CM and related Cisco collaboration products - Emergency Responder, Unified CM IM&
Cisco's batched voice-portfolio hardening release addresses several internally discovered injection-class defects (CWE-7
Cross-site scripting (XSS) in the web interfaces of Cisco Emergency Responder, Cisco Unified CM, Unified CM IM&P, Cisco
SQL injection in Cisco Unified CM and related Cisco collaboration products (Emergency Responder, Unified CM IM&P, Unifie
Cisco Unified CM and related Cisco UC products contain improper input validation that can let authenticated low-privileg
Local access-control bypass in Cisco Unified Communications products allows an authenticated low-privileged user or loca
Path traversal in Cisco Unified CM and related collaboration appliances (Emergency Responder, Prime Collaboration Deploy
Exploit-DB