Key points
- CVE-2026-76474 affects multiple Cisco collaboration products running version 14.
- The National Vulnerability Database rates the issue as critical with a CVSS score of 9.8.
- Cisco engineering teams discovered these flaws during internal security reviews.
Cisco has published software hardening releases to address multiple internally discovered vulnerabilities across several of its collaboration products. These updates target authentication issues identified during internal reviews. The National Vulnerability Database lists the flaw under CVE-2026-76474. Security teams should verify their environments against the affected versions immediately.
By the numbers
- CVSS 9.8: The severity score assigned by the National Vulnerability Database for CVE-2026-76474.
- CWE-287: The Common Weakness Enumeration category for improper authentication linked to this vulnerability.
- Version 14: The major release track for all affected Cisco products including Unified CM and Unity Connection.
What the figures mean
A CVSS score of 9.8 indicates a critical severity rating according to the National Vulnerability Database. The classification under CWE-287 points specifically to issues concerning improper authentication. The source material does not specify technical complexity or compare risks to other vulnerability types. Teams should treat this as a high-priority patching event because the vendor has released hardening updates to address these specific gaps.
Cisco engineering teams conducted comprehensive internal security reviews for Emergency Responder, Prime Collaboration Deployment, Unified CM, IM & Presence Service, Session Management Edition, and Unity Connection. These reviews identified the vulnerabilities before public disclosure. The resulting software hardening releases address these specific authentication gaps. According to the NVD record, the flaws were not reported by external researchers but found through Cisco’s own quality assurance processes.
Affected systems include Cisco Emergency Responder 14, 14SU1, 14SU2, and 14SU3. Cisco Unified Communications Manager 14, 14SU1, 14SU2, and 14SU3 are also vulnerable. Additionally, Cisco Unified Communications Manager IM and Presence Service 14, 14SU1, 14SU2, and 14SU2a require updates. Cisco Unity Connection 14, 14SU1, 14SU2, and 14SU3 are included in the list of affected versions.
What to watch
Security operations teams should monitor for unauthorized login attempts on these systems until patches are applied. While the source material does not report active exploitation, the high severity score warrants close attention to authentication logs. Administrators should verify that all systems on version 14 are updated to the latest hardening releases. Failure to patch could leave critical communication infrastructure exposed to credential-based attacks.
Infection and persistence in general
Teams usually detect authentication flaws by reviewing failed login spikes or unexpected access patterns in system logs. Analysts often examine configuration files for default credentials or disabled security controls. Persistence in these cases typically involves maintaining access through compromised user accounts rather than installing malware. Check whether multi-factor authentication is enforced on all administrative interfaces. Review network segmentation to ensure that compromised endpoints cannot easily reach critical servers.
What to do and how to stay safe: Cisco
- Inventory all Cisco collaboration products to identify systems running version 14 or its service updates.
- Apply the latest software hardening releases provided by Cisco to address the authentication vulnerabilities.
- Monitor authentication logs for unusual activity or failed login attempts from unexpected sources.
- Enforce strong password policies and multi-factor authentication for all administrative accounts on these systems.
Step-by-step guide: Patch Management Implementation: A Step-by-Step Rollout Plan
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is CVE-2026-76474 being exploited in the wild?
The source material states the vulnerabilities were discovered internally by Cisco and does not mention active exploitation.
Which Cisco products are affected by this vulnerability?
Emergency Responder, Prime Collaboration Deployment, Unified CM, IM & Presence Service, SME, and Unity Connection.
What is the CVSS score for CVE-2026-76474?
The National Vulnerability Database rates the vulnerability as 9.8, which is considered critical.
