CVE-2026-76475

Summary

Improper neutralization of input during web page generation (CWE-79) in multiple Cisco Unified Communications products allows attackers to inject malicious scripts into web pages served to users, leading to cross-site scripting (XSS) attacks that can compromise confidentiality and integrity.

Exploitability

Exploitation requires user interaction (e.g., clicking a crafted link) and network access, but no authentication or special privileges are needed.

Blast radius

Successful exploitation could enable session hijacking, credential theft, or unauthorized actions performed on behalf of authenticated users within the affected web applications.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to the patched versions specified in Cisco’s security advisory for each affected product; since no fixed version is listed in the provided description, apply vendor-recommended hardening measures immediately and monitor for further guidance.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.