Cisco hardens Unified CM and Unity Connection, fixing flaws rated up to 9.8

Cisco hardens Unified CM and Unity Connection, fixing flaws rated up to 9.8

21 October 2026: Cisco has released hardening updates for its on-premises calling and voicemail products that fix eight groups of internally found flaws, two of them rated 9.8. Unified Communications Manager, its IM & Presence and Session Management editions, Unity Connection, Emergency Responder and Prime Collaboration Deployment are all affected regardless of configuration, release 15SU5 is the first fixed release, and there are no workarounds.

Not yet independently verified. Cisco groups many underlying flaws under each CVE and has not yet published which flaw each covers; it says separate advisories may follow. It reports no public exploitation. We will update this when it can be confirmed, and remove this note.

The advisory, cisco-sa-voice-hardening-twgbH9e3, was first published on 21 October as part of Cisco's advance-notification bundle and updated on 27 October to correct a description. Cisco says it is not aware of public announcements or malicious use.

One CVE per weakness class

Instead of one advisory per bug, Cisco has grouped the results of a comprehensive internal review by their underlying weakness and assigned one CVE to each group. The score on each CVE is the maximum for the single worst flaw in that class:

CVE	Highest CVSS	Weakness class
CVE-2026-76473	9.8	Injection (CWE-74)
CVE-2026-76474	9.8	Improper authentication (CWE-287)
CVE-2026-76475	9.3	Cross-site scripting (CWE-79)
CVE-2026-76476	8.8	Improper input validation (CWE-20)
CVE-2026-76477	8.8	SQL injection (CWE-89)
CVE-2026-76478	8.8	Improper access control (CWE-284)
CVE-2026-76479	7.8	Path traversal (CWE-22)
CVE-2026-76481	7.5	Improper handling of exceptional conditions (CWE-703)

The model is the same one Cisco used for its Meraki hardening release this month. It makes patching simpler, since one upgrade covers everything, but it makes risk assessment harder: a 9.8 score says the worst flaw in a class is critical, not that every flaw is reachable without login.

Which releases are fixed

For release 15, the first fixed release is 15SU5. Release 14 has no fix; Cisco's instruction is to migrate to a fixed release. Snort rules 67356 and 67358 are listed for the advisory.

Cisco says the flaws were found in internal testing "using existing testing processes as well as frontier AI models".

Planning the upgrade

Unified CM clusters are usually upgraded in planned windows because every phone registers to them, and the move from 14 to 15 is a major upgrade rather than a service update. Teams still on 14 face the larger job and should start the migration plan now rather than wait for the individual advisories Cisco says may follow. Until then, limiting access to the administration and user web interfaces to management networks reduces exposure to the injection and authentication classes, though Cisco offers no formal workaround.

A sibling advisory of the same date covers a hardening release for Cisco Expressway, fixed in X15.5.20, which we covered with Expressway's own critical flaw.

Sources

• Cisco: Cisco Unified Communications Products Security Hardening Release (cisco-sa-voice-hardening-twgbH9e3), 21 October 2026