Cisco fixes critical XSS flaws in Unified CM, Unity Connection, Emergency Responder and Prime Collaboration Deployment

Cisco has released software hardening updates to address critical cross-site scripting vulnerabilities across several of its collaboration and communications platforms. The fixes target internally discovered flaws in how these systems handle web input, preventing potential exploitation through malicious script injection.

Which products are affected?

The vulnerabilities tracked by CVE-2026-76475 impact multiple components within Cisco’s ecosystem. Affected systems include Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Unified CM IM & Presence Service, Unified CM Session Management Edition, and Cisco Unity Connection.

What versions need updating?

Users running version 14 and its specific service updates (14SU1, 14SU2, 14SU3) on Emergency Responder, Unified CM, and Unity Connection are exposed. Unified CM IM & Presence Service users on versions 14, 14SU1, 14SU2, and 14SU2a must also apply the latest hardening releases to mitigate the risk.

How severe is the threat?

The National Vulnerability Database rates CVE-2026-76475 as critical with a CVSS score of 9.3. The underlying weakness is identified as CWE-79, which relates to improper neutralization of input during web page generation. This allows attackers to inject scripts if the application fails to sanitize user-supplied data correctly.

What triggered these patches?

Cisco engineering teams conducted a comprehensive internal security review as part of their proactive quality assurance efforts. This review identified the vulnerabilities before they were publicly disclosed or exploited in the wild. The resulting software hardening releases address these internally discovered issues to strengthen product security.

What analysts watch for

Teams usually monitor for anomalous outbound connections from collaboration servers, which may indicate script execution. Analysts check web server logs for reflected payloads containing HTML or JavaScript tags that were not sanitized. They examine session cookies for unexpected modifications that suggest cross-site scripting attempts. Reviewing browser console errors on admin interfaces can reveal injected scripts. Teams verify that input validation filters are active on all web-facing forms.

Background: National Vulnerability Database

The National Vulnerability Database lists known flaws but lacks deployment context. Do not treat every entry as an immediate emergency. Cross-reference findings with your asset inventory and usage patterns to determine real risk, rather than reacting to every new identifier.

Read the full guide: National Vulnerability Database: Five Common Misreadings and Fixes

What to do and how to stay safe: Cisco

• Verify if your environment runs any of the affected Cisco versions listed in the advisory.
• Apply the latest software hardening releases provided by Cisco to all impacted systems.
• Monitor web server logs for signs of script injection attempts or unusual input patterns.
• Restrict access to administrative interfaces to trusted networks until updates are confirmed.

Step-by-step guide: How Vulnerability Scanning Works: The Hidden Mechanics and Limits

General security guidance from the Sandbox Desk newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is this vulnerability being actively exploited?

The source material states the vulnerabilities were internally discovered during a security review, with no mention of active exploitation in the wild.

What is the CVSS score for CVE-2026-76475?

The National Vulnerability Database assigns a CVSS score of 9.3, rating the severity as critical.

Which Cisco products are not affected?

The material only lists affected products; it does not specify which versions or products are safe from this particular vulnerability.