How Cisco SQL Injection Flaw Exposes Unified CM and Emergency Responder
A high-severity SQL injection vulnerability affects multiple Cisco collaboration products, requiring immediate inventory checks by security teams.
Key points
- CVE-2026-76477 is rated CVSS 8.8 HIGH.
- The flaw involves improper neutralisation of SQL commands.
- Affected products include Unified CM and Unity Connection.
The short version
- Cisco engineering teams identified multiple internal vulnerabilities.
- The issues stem from CWE-89 SQL injection weaknesses.
- Software hardening releases address these flaws in version 14.
The details
Cisco engineering teams conducted a comprehensive internal security review of several collaboration products. This review identified multiple vulnerabilities tracked under CVE-2026-76477. The National Vulnerability Database rates the flaw as HIGH severity with a CVSS score of 8.8. The weaknesses are classified under CWE-89, involving improper neutralisation of special elements in SQL commands. Cisco has released software hardening updates to address these internally discovered issues.
The context
The vulnerability affects multiple components within the Cisco Unified Communications ecosystem. Affected products include Cisco Emergency Responder, Cisco Prime Collaboration Deployment, and Cisco Unity Connection. Cisco Unified Communications Manager is also impacted, along with its IM and Presence Service and Session Management Edition variants. The flaw exists in version 14 and its service updates SU1, SU2, and SU3. Cisco IM and Presence Service is affected in versions 14, 14SU1, 14SU2, and 14SU2a.
Next steps
Security operations teams should inventory their environments for the affected Cisco products. They must verify whether any instances are running version 14 or its service updates. If affected versions are present, teams should prioritise applying the software hardening releases. These updates address the SQL injection flaws identified during the internal review. Ensuring all systems are patched reduces the attack surface for this high-severity vulnerability.
What defenders should look for
Teams usually monitor database logs for unusual query patterns or syntax errors that indicate injection attempts. Check whether application logs show unexpected SQL errors or abnormal data retrieval requests from known endpoints. Look for authentication bypass attempts or unexpected privilege escalations following suspicious input. If such activity is detected, isolate the affected system from the network immediately. Review access controls to ensure only authorised personnel can interact with the database interfaces.
What to do and how to stay safe: Cisco
- Inventory all Cisco collaboration products to identify affected version 14 instances.
- Apply the available software hardening releases to mitigate the SQL injection risk.
- Monitor database and application logs for signs of unauthorised SQL command execution.
- Restrict network access to the affected services until patches are confirmed.
Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection
General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which CVE ID covers this Cisco vulnerability?
The vulnerability is tracked under CVE-2026-76477.
What is the severity rating of this flaw?
The National Vulnerability Database rates it as HIGH with a CVSS score of 8.8.
Which Cisco products are affected by this issue?
Affected products include Unified CM, Emergency Responder, Unity Connection, and IM and Presence Service.
