CVE-2026-76474

waiting for further signals

GHSA-mmh2-pw7w-r7pw ↗EUVD-2026-107386 ↗

no check availablenot proven exploitable

cve.orgpublic pockev

Cisco Emergency Responder 14; 14SU1; 14SU2; 14SU3; 14SU3a; 15; 15SU1; 15SU1a; 14SU4; 15SU2; 15SU3; 14SU5; 15SU4; 14SU6; 14SU4a; 15.0.1.13010-1; 15.0.1.13011-1; 15.0.1.13012-1; 15.0.1.13013-1; 15.0.1.13014-1; 15.0.1.13015-1; 15.0.1.13016-1; 15.0.1.13017-1; 15SU3a; 15SU4a; 14SU2a

CWE-287 Improper Authentication

ETK-2026-2335, permanent identifier

cvss9.8cna vendorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

47msince last run

8mAI analysis

timeline

0 = trigger signal

trigger signal (cve.org) +0hwaiting for further signals+28h32m

+2h

+4h

+6h

+8h

+10h

description

Cisco Emergency Responder, Unified Communications Manager, Unified CM IM and Presence, and Unity Connection are affected by an authentication weakness. A remote attacker may be able to access or affect an exposed system without valid credentials. Exposure requires network reachability to an affected service; the available CVSS data indicates no user interaction or prior privileges are required.

mitigation

Apply Cisco's security-hardening release for each affected product, using the vendor's release guidance to select the applicable version. Until updates are deployed, restrict network access to affected services to trusted administrative networks.

check

exploit

automation

contextual

auth required

EPSS

0.36%28th percentile

agent run time

cve.org record, t = 0

2026-10-21 16:14Z

Δ to public poc

–

Δ to kev

–

outcome

Contextual: an exploit technique exists, but no deterministic check could cover this one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-21 16:14Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-76474

this entry in the feed

GET /api/v1/feed/CVE-2026-76474

{
  "etk_id": "ETK-2026-2335",
  "cve_id": "CVE-2026-76474",
  "display_id": "CVE-2026-76474",
  "ghsa_id": "GHSA-mmh2-pw7w-r7pw",
  "euvd_id": "EUVD-2026-107386",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper authentication in Cisco Unified Communications products",
  "summary": "Cisco Emergency Responder, Unified Communications Manager, Unified CM IM and Presence, and Unity Connection are affected by an authentication weakness. A remote attacker may be able to access or affect an exposed system without valid credentials. Exposure requires network reachability to an affected service; the available CVSS data indicates no user interaction or prior privileges are required.",
  "mitigation": "Apply Cisco's security-hardening release for each affected product, using the vendor's release guidance to select the applicable version. Until updates are deployed, restrict network access to affected services to trusted administrative networks.",
  "vendor": "Cisco",
  "product": "Cisco Emergency Responder",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "14",
        "14SU1",
        "14SU2",
        "14SU3",
        "14SU3a",
        "15",
        "15SU1",
        "15SU1a",
        "14SU4",
        "15SU2",
        "15SU3",
        "14SU5",
        "15SU4",
        "14SU6"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Cisco Emergency Responder",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "14",
        "14SU1",
        "14SU2",
        "14SU3",
        "15",
        "15SU1",
        "14SU4",
        "14SU4a",
        "15SU1a",
        "15SU2",
        "15.0.1.13010-1",
        "15.0.1.13011-1",
        "15.0.1.13012-1",
        "15.0.1.13013-1",
        "15.0.1.13014-1",
        "15.0.1.13015-1",
        "15.0.1.13016-1",
        "15.0.1.13017-1",
        "15SU3a",
        "14SU5",
        "15SU4",
        "15SU4a",
        "14SU6"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Cisco Unified Communications Manager",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "14",
        "14SU1",
        "14SU2",
        "14SU2a",
        "14SU3",
        "15",
        "15SU1",
        "14SU4",
        "15SU2",
        "15SU3",
        "14SU5",
        "15SU4",
        "14SU6"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Cisco Unified Communications Manager IM and Presence Service",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "14",
        "14SU1",
        "14SU2",
        "14SU3",
        "14SU3a",
        "15",
        "15SU1",
        "14SU4",
        "15SU2",
        "15SU3",
        "14SU5",
        "15SU4",
        "14SU6"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Cisco Unity Connection",
      "purl": null
    }
  ],
  "cwes": [
    287
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0036,
  "epss_percentile": 0.2822,
  "epss_asof": "2026-10-22",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 8.3251439,
  "t0_at": "2026-10-21T16:14:48.265000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-21T16:14:48.265000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-21T16:14:48.265000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76474"
    }
  }
}

published 2026-10-21 17:14Z
last change 2026-10-22 20:46Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.