CVE-2026-76473, CVE-2026-76474, CVE-2026-76475 & CVE-2026-20043: Four Critical Cisco Unified Communications CVEs (CVSS up to 9.8) — Detection and Remediation Guide

Cisco's Unified Communications (UC) product suite just absorbed four critical, network-exploitable vulnerabilities in a single disclosure wave — and if your organization runs Cisco Unified Communications Manager (Unified CM), Unified CM IM & Presence, Emergency Responder, or Prime Collaboration Deployment, this is your remediation priority this week.

NVD published four CRITICAL CVEs in the last three days: CVE-2026-76473 (CVSS 9.8), CVE-2026-76474 (CVSS 9.8), CVE-2026-76475 (CVSS 9.3), and CVE-2026-20043. The affected product list spans the heart of enterprise voice and collaboration infrastructure:

• Cisco Unified Communications Manager (Unified CM)
• Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P)
• Cisco Unified Communications Manager Session Management Edition (SME)
• Cisco Emergency Responder
• Cisco Prime Collaboration Deployment

A 9.8 network-vector score on collaboration infrastructure is about as bad as it gets in severity terms. UC clusters sit inside the network core, hold SIP credentials and call metadata, integrate with Active Directory/LDAP, and are frequently reachable from broad internal segments — including, in far too many environments I've assessed, from user VLANs and VPN pools. A compromise here doesn't just give an attacker a Linux appliance; it gives them a pivot point into identity infrastructure and a platform for toll fraud, call interception, and lateral movement.

Technical Analysis

What We Know

The NVD entries describe these vulnerabilities as the product of Cisco's proactive internal security engineering work — meaning Cisco's own teams discovered the flaws rather than an external report of active exploitation. That is good news on one axis: as of publication, there is no confirmed in-the-wild exploitation and no CISA KEV listing for these CVEs. Do not let that lull you into a slow patch cycle. The gap between NVD publication and working exploit code for network-reachable, unauthenticated-style criticals in widely deployed Cisco products has historically been measured in days to weeks, not months. Threat actors monitor Cisco security advisories precisely because the affected install base is enormous and patching UC clusters requires maintenance windows that defenders routinely defer.

Severity Breakdown

A CVSS 9.8 with a network attack vector implies the exploitation preconditions are minimal — low complexity, no user interaction, and (in the overwhelming majority of 9.8-scored web/management-plane flaws) no authentication. Until Cisco's full advisory text is parsed and confirmed against your environment, treat the worst case as unauthenticated remote code execution against the management/web service plane of these appliances and defend accordingly.

Defender's Threat Model

These appliances run Cisco's hardened VOS (a RHEL-derived locked-down platform). You do not get arbitrary shell on them easily — but that cuts both ways. From a detection standpoint, the realistic observable surface is:

1. The web management and serviceability interfaces (HTTPS, typically TCP 443/8443) — the most probable attack surface for network-vector criticals in this product family.
2. The appliance's underlying Tomcat/Java web stack — exploitation of a management-plane flaw frequently manifests as the web service process spawning unexpected child processes (shells, curl/wget to pull second-stage payloads, base64 decode pipelines).
3. Anomalous network behavior from the UC hosts themselves — UC appliances have an extremely predictable outbound traffic profile (NTP, DNS, LDAP/AD, CDR pushes, SFTP backups, Cisco cloud services). Any novel outbound connection, especially to the internet or to internal segments the appliance doesn't normally touch, is high-signal.
4. Authentication anomalies on the admin/CLI plane — successful exploitation or follow-on activity may involve new sessions to the platform CLI or OS Administration pages from unusual sources.

Because these CVEs were internally discovered and full technical details are limited at publication time, the detections below are built around the exploitation behavior of network-vector criticals against this appliance class — not fabricated indicators. Deploy them as hunt logic and tune against your baseline.

Detection & Response

SIGMA Rules

These two rules target the highest-fidelity post-exploitation behaviors on the UC appliances themselves (ingested via Syslog from the VOS platform or a forwarder) and on adjacent monitoring systems. The process-creation rule assumes you are forwarding audit/exec logs from the appliances or from a sensor with visibility into them — if you don't have that telemetry today, the VQL and KQL sections below give you network-side alternatives.

---
title: Cisco UC Appliance Web Service Spawning Suspicious Child Process
id: 6f1e8a72-3c4d-4a5b-9e2f-7b8c9d0e1f2a
status: experimental
description: Detects the Tomcat/Java web service or platform service account on Cisco Unified Communications appliances spawning shell interpreters, downloaders, or encoding utilities — consistent with post-exploitation of network-vector management-plane vulnerabilities such as CVE-2026-76473 / CVE-2026-76474.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76473
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/tomcat'
      - '/java'
      - '/catalina'
  selection_image:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
      - '/base64'
      - '/openssl'
  condition: selection_parent and selection_image
falsepositives:
  - Rare Cisco TAC-directed diagnostic activity; validate against change tickets
level: high
---
title: Encoded or Download Cradle Execution From Cisco UC Appliance Host
id: 2b7c4d91-8e3f-4a6b-b1c5-9d0e2f3a4b5c
status: experimental
description: Detects shell command lines containing base64 decode pipelines, reverse-shell constructs, or remote fetch-and-execute patterns originating from hosts identified as Cisco Unified Communications appliances. High-fidelity indicator of post-exploitation following management-plane compromise.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76473
  - https://attack.mitre.org/techniques/T1027/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
  - attack.defense_evasion
  - attack.t1027
logsource:
  category: process_creation
  product: linux
detection:
  selection_cradle:
    CommandLine|contains:
      - 'base64 -d'
      - 'base64 --decode'
      - '| sh'
      - '| bash'
      - '/dev/tcp/'
      - 'curl http'
      - 'wget http'
      - 'chmod +x /tmp/'
      - 'chmod +x /var/tmp/'
  filter_legit:
    CommandLine|contains:
      - '/opt/cisco/'
      - '/usr/local/cm/'
  condition: selection_cradle and not filter_legit
falsepositives:
  - Cisco upgrade/COP file installation scripts run from /opt/cisco and /usr/local/cm paths — filtered above
level: critical

KQL — Microsoft Sentinel Hunt

UC appliances are network-side assets, so the practical Sentinel hunt runs against syslog/CEF ingestion and firewall logs. This query hunts for novel outbound destinations from UC appliance hosts — the single most reliable tell that one of these appliances has been popped, because their egress profile is boringly stable.

// Hunt: novel outbound connections from Cisco UC appliances
// Tune the $UCSubnets and $KnownGoodEgress lists to your environment FIRST.
let UCSubnets = dynamic(["10.20.30.", "10.20.31."]);          // <-- your UC cluster subnets
let Lookback = 7d;
let Baseline = 30d;
let KnownGoodEgress = dynamic(["ntp.org", "cisco.com", "cloudfront.net"]);
// Build 30-day baseline of destinations each UC host talks to
let baseline =
    CommonSecurityLog
    | where TimeGenerated between (ago(Baseline) .. ago(Lookback))
    | where SourceIP has_any (UCSubnets)
    | where IsEmpty(DestinationIP) == false
    | summarize by SourceIP, DestinationIP;
// Surface 7-day connections absent from the baseline
CommonSecurityLog
| where TimeGenerated >= ago(Lookback)
| where SourceIP has_any (UCSubnets)
| where IsEmpty(DestinationIP) == false
| where DestinationIP !has_any (UCSubnets)
| summarize ConnCount=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated),
            Ports=make_set(DestinationPort), Actions=make_set(DeviceAction)
    by SourceIP, DestinationIP
| where SourceIP !in (baseline | project SourceIP) or DestinationIP !in (baseline | project DestinationIP)
| extend DestinationIP_str = tostring(DestinationIP)
| join kind=leftanti (
    baseline | summarize by DestinationIP_str = tostring(DestinationIP)
) on DestinationIP_str
| project SourceIP, DestinationIP, Ports, ConnCount, FirstSeen, LastSeen, Actions
| order by ConnCount asc;

A companion query for Syslog-ingested appliance events — looking for admin-plane logons from unusual sources:

// Hunt: administrative authentication to UC appliances from non-jumpbox sources
let ApprovedAdminSources = dynamic(["10.10.5.10", "10.10.5.11"]);  // <-- jumpboxes / PAWs
Syslog
| where TimeGenerated >= ago(7d)
| where Computer has_any ("cucm", "imp", "cer", "pcd") or HostIP has_any ("10.20.30.", "10.20.31.")
| where SyslogMessage has_any ("login", "session opened", "authentication success", "cli session")
| extend SrcIP = extract(@"([0-9]{1,3}\.){3}[0-9]{1,3}", 0, SyslogMessage)
| where SrcIP !in (ApprovedAdminSources)
| summarize Events=count(), Samples=make_set(SyslogMessage, 5) by Computer, HostIP, SrcIP, bin(TimeGenerated, 1h)
| order by TimeGenerated desc;

Velociraptor VQL — Connection & Process Hunt

If you run Velociraptor on management subnets or adjacent collectors, this artifact snapshots live connections and processes to catch an appliance-adjacent foothold or a compromised jumpbox being used to reach the UC management plane.

-- Hunt: processes and connections touching Cisco UC management ports
-- from non-approved sources (run against jumpboxes/admin workstations and collectors)
SELECT Pid, Name, Path, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(cucm|ccmadmin|ccmservice|osadmin|platform/admin)'
   OR CommandLine =~ '(?i)(ssh .*10\.20\.3[01]\.|https://10\.20\.3[01]\.)'

-- Live netstat: connections to UC appliance management ports (443, 8443, 22)
LET uc_conn = SELECT * FROM netstat()
WHERE (RemoteIP =~ '^10\\.20\\.3[01]\\.' AND RemotePort in (22, 443, 8443))
   OR (LocalPort in (22, 443, 8443) AND Status =~ 'ESTABLISHED')
SELECT Pid, Name, LocalIP, LocalPort, RemoteIP, RemotePort, Status, Pname
FROM uc_conn

Remediation & Verification Script

Because VOS appliances are locked down, "patching" means installing Cisco's fixed releases / COP files through the standard upgrade process. The script below does what you can automate today from your management network: inventory exposed UC management interfaces, verify which hosts answer on management ports, and confirm access-control posture. Run it from an admin Linux host with nmap.

#!/usr/bin/env bash
# Cisco UC CVE-2026-76473/76474/76475 exposure audit
# Run from an approved admin host. Adjust UC_NETS to your environment.
set -euo pipefail

UC_NETS="10.20.30.0/24 10.20.31.0/24"     # <-- your UC subnets
REPORT="uc_exposure_$(date +%F).txt"

echo "=== Cisco UC exposure audit: $(date) ===" | tee "$REPORT"

# 1. Discover live UC hosts with management plane exposed
echo "--- Hosts with management/web plane listening (443/8443/22) ---" | tee -a "$REPORT"
nmap -Pn -sS -p 22,443,8443,8080 --open -oG - $UC_NETS 2>/dev/null \
  | awk '/Ports:/ {print $2, $0}' | tee -a "$REPORT"

# 2. Flag management interfaces reachable from OUTSIDE approved admin subnets.
#    Re-run this nmap from a USER-VLAN or VPN-pool host; any hit on 443/8443/22
#    means your management plane is reachable from segments attackers land on first.
echo "--- ACTION: re-run this scan from a user VLAN / VPN host." | tee -a "$REPORT"
echo "    Any UC host answering 443/8443/22 from user space = ACL gap." | tee -a "$REPORT"

# 3. Collect software versions (requires platform CLI access via SSH)
for host in $(nmap -Pn -p 22 --open -oG - $UC_NETS 2>/dev/null | awk '/22\/open/{print $2}'); do
  echo "--- $host: installed version ---" | tee -a "$REPORT"
  ssh -o ConnectTimeout=5 -o StrictHostKeyChecking=no "admin@${host}" \
    'show version active' 2>/dev/null | tee -a "$REPORT" || \
    echo "    (SSH auth failed — check manually via OS Administration)" | tee -a "$REPORT"
done

# 4. Egress baseline: UC hosts should only reach NTP/DNS/AD/SFTP-backup/Cisco cloud.
echo "--- ACTION: compare this list against firewall egress logs for novel destinations ---" | tee -a "$REPORT"
echo "Done. Review $REPORT and cross-check versions against Cisco advisory fixed releases." | tee -a "$REPORT"

Remediation

1. Pull the Cisco Security Advisories for all four CVEs immediately. Start at the NVD entries (CVE-2026-76473, CVE-2026-76474, CVE-2026-76475, CVE-2026-20043) and follow the linked Cisco advisory for the exact fixed release per product and train. Do not guess at fixed versions — UC version-to-fix mapping is train-specific (e.g., 12.5 vs 14 vs 15 SU levels), and applying the wrong COP file wastes a maintenance window.
2. Inventory every UC node — including subscribers and IM&P nodes you forgot about. In every IR engagement involving UC infrastructure, the client has had at least one unpatched node nobody remembered (typically an Emergency Responder box or a PCD server used once for a migration years ago). PCD in particular is often deployed, used for a single migration, and then left running and unpatched indefinitely. Confirm whether it's still needed; if not, power it off and decommission it.
3. Restrict the management plane today — don't wait for the patch window. UC administration interfaces (OS Administration, Serviceability, platform CLI/SSH) should be reachable only from a dedicated management subnet or jumpbox. Enforce this with ACLs on the adjacent switch/firewall. If the flaw is unauthenticated and network-reachable, segmentation is your compensating control while patches are scheduled.
4. Audit internet exposure. No UC management interface should ever be reachable from the internet. Check your external attack surface (and your Shadow IT) for anything answering on 443/8443 that presents a Cisco Unified CM / Emergency Responder login page.
5. Schedule emergency patching under your change policy. CVSS 9.8 × 2 plus a 9.3 across the voice core justifies an expedited change. Stage in this order: internet-adjacent or broadly reachable nodes first, then publisher, then subscribers, then IM&P.
6. Hunt before you patch. Apply the KQL novel-egress query against the last 30 days now, not after remediation. If an appliance was already compromised, patching over it leaves the attacker's persistence in place. Any hit on the egress or auth anomalies above → treat as an incident, isolate the node, and engage IR before rebuilding.
7. Watch CISA KEV. These are not KEV-listed at publication. If any of the four lands there, federal deadlines (typically 21 days for civilian agencies, and effectively the de facto enterprise standard) apply — but at 9.8 network-vector, you should be beating that clock regardless.

Bottom line: internally discovered doesn't mean safe — it means you have a head start. Use it. Segment the management plane this afternoon, baseline egress tonight, and get the fixed releases scheduled before exploit code catches up to the advisory.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub