Cisco Product Security Update Advisory

A security update addressing vulnerabilities in Cisco products has been released. Users of these products should update to the latest version.

Cisco Expressway Series. Versions X14 and earlier, X15.5.3 and earlier. – Cisco Emergency Responder. Versions 14 and 15. – Cisco Prime Collaboration Deployment. Versions 14 and 15.
Cisco Unified Communications Manager (Unified CM). Versions 14 and 15. – Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P). Versions 14 and 15.
Cisco Unified Communications Manager Session Management Edition (Unified CM SME). Versions 14 and 15. – Cisco Unity Connection. Versions 14 and 15.

CVE-2026-76466. An unauthenticated remote code execution vulnerability in the Cisco Expressway Series. – CVE-2026-76473. A vulnerability involving improper handling of special characters in output.
CVE-2026-76474. A vulnerability involving improper authentication. – CVE-2026-76475. An XSS vulnerability (a vulnerability that allows malicious scripts to be injected into web pages).
CVE-2026-76476. A vulnerability due to improper input validation. – CVE-2026-76477. An SQL injection vulnerability.
CVE-2026-76478. This is an improper access control vulnerability. – CVE-2026-76479. This is a path traversal vulnerability. – CVE-2026-76481. This is an improper exception handling vulnerability.

CVE-2026-76466. Cisco Expressway Series versions X14 and earlier must be upgraded to a patched version as directed by Cisco; version X15.5.20 has been recommended.
The remaining affected products must be upgraded to a patched version as per Cisco’s guidance; version 15SU5 has been recommended.

Cisco provided information on Vulnerability Patches through related security advisories and hardening releases.