{"id":"CVE-2026-76419","title":"Cisco Unified Communications Manager Cross-Site Scripting Vulnerability","summary":"A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attack…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"Cisco","product":"Cisco Unified Communications Manager","affected":["unified_communications_manager 14","unified_communications_manager 14SU1","unified_communications_manager 14SU2","unified_communications_manager 14SU3","unified_communications_manager 15","unified_communications_manager 15SU1","unified_communications_manager 14SU4","unified_communications_manager 14SU4a","unified_communications_manager 15SU1a","unified_communications_manager 15SU2","unified_communications_manager 15.0.1.13010-1","unified_communications_manager 15.0.1.13011-1","unified_communications_manager 15.0.1.13012-1","unified_communications_manager 15.0.1.13013-1","unified_communications_manager 15.0.1.13014-1","unified_communications_manager 15.0.1.13015-1","unified_communications_manager 15.0.1.13016-1","unified_communications_manager 15.0.1.13017-1","unified_communications_manager 15SU3a","unified_communications_manager 14SU5","unified_communications_manager 15SU4","unified_communications_manager 15SU4a","unified_communications_manager 14SU6"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-04T18:16:28.347300Z"},"published":"2026-11-04","updated":"2026-11-04","sourceUpdated":"2026-11-04T18:16:39.075Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-76419","references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-xss-5mQn2U5z","label":"cisco-sa-cucm-xss-5mQn2U5z"}],"tags":["cve.org"],"ingestedAt":"2026-11-05T21:36:00.481Z","slug":"CVE-2026-76419","body":"## Overview\n\nA vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.\r\n\r\nThis vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.\n\n## Affected\n\n- `unified_communications_manager 14`\n- `unified_communications_manager 14SU1`\n- `unified_communications_manager 14SU2`\n- `unified_communications_manager 14SU3`\n- `unified_communications_manager 15`\n- `unified_communications_manager 15SU1`\n- `unified_communications_manager 14SU4`\n- `unified_communications_manager 14SU4a`\n- `unified_communications_manager 15SU1a`\n- `unified_communications_manager 15SU2`\n- `unified_communications_manager 15.0.1.13010-1`\n- `unified_communications_manager 15.0.1.13011-1`\n- `unified_communications_manager 15.0.1.13012-1`\n- `unified_communications_manager 15.0.1.13013-1`\n- `unified_communications_manager 15.0.1.13014-1`\n- `unified_communications_manager 15.0.1.13015-1`\n- `unified_communications_manager 15.0.1.13016-1`\n- `unified_communications_manager 15.0.1.13017-1`\n- `unified_communications_manager 15SU3a`\n- `unified_communications_manager 14SU5`\n- `unified_communications_manager 15SU4`\n- `unified_communications_manager 15SU4a`\n- `unified_communications_manager 14SU6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}