SQL Injection Vulnerability in Cisco Unified Communications Products
CVE-2026-76477

8.8HIGH

Key Information:

Vendor

Cisco
Status
Cisco Emergency Responder
Cisco Unified Communications Manager
Cisco Unified Communications Manager Im And Presence Service
Cisco Unity Connection
Vendor
CVE Published:
21 October 2026

Badges

👾 Exploit Exists

What is CVE-2026-76477?

Cisco has identified multiple vulnerabilities across several of its Unified Communications products due to improper neutralization of special elements used in SQL commands. This vulnerability could allow an attacker to execute unauthorized SQL commands, leading to potential data leakage or manipulation. Cisco's engineering teams have released software updates to address these vulnerabilities, reinforcing the security posture of their communications solutions.

Affected Version(s)

Cisco Emergency Responder 14

Cisco Emergency Responder 14SU1

Cisco Emergency Responder 14SU2

References

https://sec.cloudapps.cisco.com/security/center/content/C...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.