CVE-2026-76419

MediumCVSS 6.1/10Last modified Nov 6, 2026

Description

A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
CiscoCisco Unified Communications Manager14; 14SU1; 14SU2; 14SU3; 15; 15SU1; 14SU4; 14SU4a; 15SU1a; 15SU2; 15.0.1.13010-1; 15.0.1.13011-1; 15.0.1.13012-1; 15.0.1.13013-1; 15.0.1.13014-1; 15.0.1.13015-1; 15.0.1.13016-1; 15.0.1.13017-1; 15SU3a; 14SU5

References

Timeline

Published
Nov 4, 2026
Last modified
Nov 6, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-76426.3A vulnerability was detected in pskill9 website-downloader up to 0.1.0. This affects the function download_website of the file src/index.ts CVE-2026-764209.0A vulnerability in the internal configuration of the Apache JServ Protocol (AJP) connector for Cisco Secure FMC Software could allow anCVE-2026-7642310.0A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to gain administrative accessCVE-2026-764247.2A vulnerability in the REST API of Cisco ISE could allow an authenticated, remote attacker to upload or copy arbitrary files on an affected CVE-2026-764257.6A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend CVE-2026-764264.9A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attackCVE-2026-764274.9A vulnerability in the offline profiler feed service of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files thatCVE-2026-764284.9A vulnerability in the REST APIs of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacCVE-2026-76434.3A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This impacts an unknown function of the file Next.js of the component API EndCVE-2026-764314.9A vulnerability in the file management function of the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authentiCVE-2026-764324.9A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker with admiCVE-2026-764335.3A vulnerability in the client provisioning download feature of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker t
CVE-2026-76419: Medium severity, CVSS 6.1 | Vulnix