CVE-2026-76419: Cisco Unified Communications Manager Cross-Site Scripting Vulnerability
Cisco · Cisco Unified Communications Manager
No fix listed · Affected: Cisco Unified Communications Manager · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.04 (4 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
No EPSS score yet. The score appears once FIRST publishes it.
DescriptionNVD
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 5 Nov.
- Cisco patches flaws in UCS Central, ISE and Unified CMSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.