Cisco Unified CM CVE-2026-76487

Exploitation requires network access to the HTTP/web interface of an affected Cisco Unified CM or Unified CM SME device; the attacker sends a crafted HTTP request that defeats improper input validation (CWE-749: exposed dangerous method or function). No authentication (PR:N) and no user interaction (UI:N) are required. Limiting factors: the attacker must be able to reach the device's HTTP service over the network, so instances restricted to trusted management VLANs or behind firewalls are far less exposed than those reachable from untrusted segments; impact is bounded to integrity-only access-control bypass (no data disclosure or service disruption per the CVSS vector). The specific vulnerable endpoint is not named in the description.

This is a moderate-severity (CVSS 5.3) access control bypass in Cisco Unified Communications Manager. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes the worst-case favorable attacker conditions - network-reachable, low-complexity, unauthenticated, no user interaction - which normally signals high priority. However, the impact is deliberately narrow: only partial integrity impact (I:L) with no confidentiality (C:N) or availability (A:N) loss, consistent with the described outcome of reaching network segments beyond intended scope rather than data theft or code execution. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV and no public exploit code was referenced, so there is no public exploit identified at time of analysis - do not treat this as actively exploited. SSVC-style framing: exploitation is 'none' observed, technical impact is 'partial', and automatability is uncertain from available data. Net assessment: a genuine but second-tier issue - easy to reach but limited blast radius. Patch within normal cycles rather than emergency response, prioritizing internet-exposed or untrusted-segment-reachable Unified CM instances.

An unauthenticated attacker with network reachability to a Unified CM device crafts and sends a malformed HTTP request that bypasses input validation, causing the application to honor a request it should have rejected. This lets the attacker reach administrative or internal network functions beyond their intended access boundary. No public proof-of-concept was referenced in the available data.