{"affected":[{"defaultStatus":"unknown","product":"Cisco Unified Communications Manager","source":"CNA: cisco","vendor":"Cisco","versions":[{"status":"affected","version":"14"},{"status":"affected","version":"14SU1"},{"status":"affected","version":"14SU2"},{"status":"affected","version":"14SU3"},{"status":"affected","version":"15"},{"status":"affected","version":"15SU1"},{"status":"affected","version":"14SU4"},{"status":"affected","version":"14SU4a"},{"status":"affected","version":"15SU1a"},{"status":"affected","version":"15SU2"},{"status":"affected","version":"15.0.1.13010-1"},{"status":"affected","version":"15.0.1.13011-1"},{"status":"affected","version":"15.0.1.13012-1"},{"status":"affected","version":"15.0.1.13013-1"},{"status":"affected","version":"15.0.1.13014-1"},{"status":"affected","version":"15.0.1.13015-1"},{"status":"affected","version":"15.0.1.13016-1"},{"status":"affected","version":"15.0.1.13017-1"},{"status":"affected","version":"15SU3a"},{"status":"affected","version":"14SU5"},{"status":"affected","version":"15SU4"},{"status":"affected","version":"15SU4a"},{"status":"affected","version":"14SU6"}]}],"cveId":"CVE-2026-76419","cwes":["CWE-79"],"description":"A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.\r\n\r\nThis vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.1,"severity":"medium","source":"CNA: cisco","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},{"score":6.1,"severity":"medium","source":"NVD: psirt@cisco.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1793816199075,"publishedAt":1793809623471,"references":[{"source":"CNA: cisco","tags":[],"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-xss-5mQn2U5z"},{"source":"psirt@cisco.com","tags":[],"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-xss-5mQn2U5z"}],"remediation":[],"revision":"dda22d3d93f423ea7b7f534f1393d9e45f4fd6a40b501c7ca05620e964721d01","sources":[{"modifiedAt":1793816199075,"name":"CNA: cisco","retrievedAt":1793819468790,"url":"https://www.cve.org/CVERecord?id=CVE-2026-76419"},{"modifiedAt":1793812656877,"name":"NVD","retrievedAt":1793816720279,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76419"}],"ssvc":{"assessedAt":1793816188347,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Cisco Unified Communications Manager Cross-Site Scripting Vulnerability","updatedAt":1793819468790}