Skip to content
NewA calmer, faster ZeroHour
StoryAdvisoryhigh

Cisco patches Unified CM access-control flaw in October hardening

1 source · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Cisco has released October 2026 Unified Communications updates for internally found flaws, including an unauthenticated Unified CM access-control bug with no workaround.

Cisco published an October 2026 security hardening release for several Unified Communications products after an internal review. The release covers Emergency Responder, Prime Collaboration Deployment, Unity Connection, Unified CM, Unified CM IM&P, and Unified CM SME. A separate advisory describes an improper access-control flaw in Unified CM and Unified CM SME: improper validation of specific HTTP requests lets an unauthenticated remote attacker send a crafted request and reach network areas beyond intended access. Cisco has released software updates, says no workarounds address that flaw, and says the issues are not known to be actively exploited. The advisories do not name CVE identifiers or fixed versions.

Key facts
  • Unified CM and Unified CM SME are affected by the access-control flaw.
  • Unauthenticated attackers can send crafted HTTP requests.
  • Cisco released updates and says no workarounds exist for that flaw.
  • Cisco says the issues were found in internal testing and are not known to be exploited.
  • Covered products also include Emergency Responder, Prime Collaboration Deployment, Unity Connection, and Unified CM IM&P.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 21, 2026Cisco publishes Unified Communications hardening and access-control advisory. · Cisco Security Advisories

What each outlet adds

beyond the shared facts
  • Cisco Security AdvisoriesDetails the unauthenticated Unified CM HTTP access-control flaw and lack of workarounds.
  • Cisco Security AdvisoriesLists the broader product set and says issues are not known exploited.
Vendors
Cisco
Products
Cisco Unified Communications ManagerCisco Unified Communications Manager Session Management EditionCisco Emergency ResponderCisco Prime Collaboration DeploymentCisco Unified Communications Manager IM & Presence ServiceCisco Unity Connection

Coverage

oldest first · one row per article · UTC
  1. · 4d ago Cisco Security AdvisoriesFirst report

    Cisco Unified CM flaw lets remote attackers bypass access control

    Crafted HTTP requests can reach network areas beyond intended access on Unified CM and Unified CM SME; updates exist and workarounds do not.

  2. · 4d ago Cisco Security Advisories

    Cisco UC products get October 2026 hardening for internal flaws

    Cisco says the issues were found in internal testing and are not known to be exploited.