CVE-2026-76478
Noticias y reportajes en Orbitaley
Como parte del compromiso continuo de Cisco con la seguridad proactiva y la calidad de sus productos, los equipos de ingeniería de Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME) y Cisco Unity Connection han llevado a cabo una revisión interna exhaustiva de seguridad. Esta revisión ha dado lugar a versiones de endurecimiento de software que corrigen múltiples vulnerabilidades descubiertas internamente.
Leer descripción completaMostrar menos
Las vulnerabilidades registradas con el identificador CVE-2026-76478 están relacionadas con problemas de control de acceso inadecuado, agrupados bajo el pilar de la Enumeración de Debilidades Comunes (CWE) CWE-284.
Traducción automática del texto original de NVD (en inglés).
CVSS
- Puntuación base
- 8.8
- Versión
- 3.1
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Probabilidad de explotación (EPSS)
FIRST aún no ha puntuado esta CVE (habitual en CVEs muy recientes o rechazadas).
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1068Exploitation for Privilege Escalationprivilege escalation85 %
El vector CVSS es AV:L/PR:L/UI:N, es decir, acceso local con privilegios bajos sin interacción, y el CWE-284 indica control de acceso indebido. El texto no describe qué consigue el atacante.
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (6)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
CWE
- CWE-284
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-76478",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Primary",
"source": "psirt@cisco.com",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 8.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 6,
"exploitabilityScore": 2
}
]
},
"affected": [
{
"source": "psirt@cisco.com",
"affectedData": [
{
"vendor": "Cisco",
"product": "Cisco Emergency Responder",
"versions": [
{
"status": "affected",
"version": "14"
},
{
"status": "affected",
"version": "14SU1"
},
{
"status": "affected",
"version": "14SU2"
},
{
"status": "affected",
"version": "14SU3"
},
{
"status": "affected",
"version": "14SU3a"
},
{
"status": "affected",
"version": "15"
},
{
"status": "affected",
"version": "15SU1"
},
{
"status": "affected",
"version": "15SU1a"
},
{
"status": "affected",
"version": "14SU4"
},
{
"status": "affected",
"version": "15SU2"
},
{
"status": "affected",
"version": "15SU3"
},
{
"status": "affected",
"version": "14SU5"
},
{
"status": "affected",
"version": "15SU4"
},
{
"status": "affected",
"version": "14SU6"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Cisco",
"product": "Cisco Unified Communications Manager",
"versions": [
{
"status": "affected",
"version": "14"
},
{
"status": "affected",
"version": "14SU1"
},
{
"status": "affected",
"version": "14SU2"
},
{
"status": "affected",
"version": "14SU3"
},
{
"status": "affected",
"version": "15"
},
{
"status": "affected",
"version": "15SU1"
},
{
"status": "affected",
"version": "14SU4"
},
{
"status": "affected",
"version": "14SU4a"
},
{
"status": "affected",
"version": "15SU1a"
},
{
"status": "affected",
"version": "15SU2"
},
{
"status": "affected",
"version": "15.0.1.13010-1"
},
{
"status": "affected",
"version": "15.0.1.13011-1"
},
{
"status": "affected",
"version": "15.0.1.13012-1"
},
{
"status": "affected",
"version": "15.0.1.13013-1"
},
{
"status": "affected",
"version": "15.0.1.13014-1"
},
{
"status": "affected",
"version": "15.0.1.13015-1"
},
{
"status": "affected",
"version": "15.0.1.13016-1"
},
{
"status": "affected",
"version": "15.0.1.13017-1"
},
{
"status": "affected",
"version": "15SU3a"
},
{
"status": "affected",
"version": "14SU5"
},
{
"status": "affected",
"version": "15SU4"
},
{
"status": "affected",
"version": "15SU4a"
},
{
"status": "affected",
"version": "14SU6"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Cisco",
"product": "Cisco Unified Communications Manager IM and Presence Service",
"versions": [
{
"status": "affected",
"version": "14"
},
{
"status": "affected",
"version": "14SU1"
},
{
"status": "affected",
"version": "14SU2"
},
{
"status": "affected",
"version": "14SU2a"
},
{
"status": "affected",
"version": "14SU3"
},
{
"status": "affected",
"version": "15"
},
{
"status": "affected",
"version": "15SU1"
},
{
"status": "affected",
"version": "14SU4"
},
{
"status": "affected",
"version": "15SU2"
},
{
"status": "affected",
"version": "15SU3"
},
{
"status": "affected",
"version": "14SU5"
},
{
"status": "affected",
"version": "15SU4"
},
{
"status": "affected",
"version": "14SU6"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Cisco",
"product": "Cisco Unity Connection",
"versions": [
{
"status": "affected",
"version": "14"
},
{
"status": "affected",
"version": "14SU1"
},
{
"status": "affected",
"version": "14SU2"
},
{
"status": "affected",
"version": "14SU3"
},
{
"status": "affected",
"version": "14SU3a"
},
{
"status": "affected",
"version": "15"
},
{
"status": "affected",
"version": "15SU1"
},
{
"status": "affected",
"version": "14SU4"
},
{
"status": "affected",
"version": "15SU2"
},
{
"status": "affected",
"version": "15SU3"
},
{
"status": "affected",
"version": "14SU5"
},
{
"status": "affected",
"version": "15SU4"
},
{
"status": "affected",
"version": "14SU6"
}
],
"defaultStatus": "unknown"
}
]
}
],
"published": "2026-10-21T17:19:07.650",
"references": [
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-hardening-twgbH9e3",
"source": "psirt@cisco.com"
}
],
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"type": "Primary",
"source": "psirt@cisco.com",
"description": [
{
"lang": "en",
"value": "CWE-284"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-76478 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284."
}
],
"lastModified": "2026-10-21T18:54:37.403",
"sourceIdentifier": "psirt@cisco.com"
}