Cross-site scripting in Cisco Unified Communications Manager
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The web-based management interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition is affected in versions listed from 14 onward. The interface does not properly validate user-supplied input, which is a cross-site scripting flaw (CWE-79). An unauthenticated remote attacker can persuade a user to click a crafted link to run script in the interface or access browser-based information.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Description from the CNA
A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cisco | Cisco Unified Communications Manager | 14; 14SU1; 14SU2; 14SU3; 15; 15SU1; 14SU4; 14SU4a; 15SU1a; 15SU2; 15.0.1.13010-1; 15.0.1.13011-1; 15.0.1.13012-1; 15.0.1.13013-1; 15.0.1.13014-1; 15.0.1.13015-1; 15.0.1.13016-1; 15.0.1.13017-1; 15SU3a; 14SU5; 15SU4; 15SU4a; 14SU6 | — | No fix listed | CNA |
- Cisco Unified Communications Manager VendorCisco Affected 14; 14SU1; 14SU2; 14SU3; 15; 15SU1; 14SU4; 14SU4a; 15SU1a; 15SU2; 15.0.1.13010-1; 15.0.1.13011-1; 15.0.1.13012-1; 15.0.1.13013-1; 15.0.1.13014-1; 15.0.1.13015-1; 15.0.1.13016-1; 15.0.1.13017-1; 15SU3a; 14SU5; 15SU4; 15SU4a; 14SU6 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for Cisco Unified Communications Manager.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Timeline
- 2026-11-04 Threatist record created from CVE-2026-76419
- 2026-11-04 CISA SSVC decision points changed
- 2026-11-04 Priority changed: MEDIUM → LOW
- 2026-11-04 Alias added: GHSA-whp5-c4f8-h8ch
References
Other 1
More Cisco vulnerabilities
- TI-2026-74174 Arbitrary file write in Cisco Secure Email Gateway via AMP feature KEVCVSS 3.1CRITICAL 9.8
- TI-2026-53490 Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2026-53489 Cisco Secure Email Gateway SQL Injection Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2026-53488 Cisco Identity Services Engine Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 10.0
- TI-2026-16388 Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 10.0
- TI-2026-16344 Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 10.0
Sources
- CVE-2026-76419 · CVE Program
- CVE-2026-76419 · NVD
- FIRST EPSS
- GHSA-whp5-c4f8-h8ch · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences