Cisco Unified Communications Manager Cross-Site Scripting Vulnerability

The vulnerability exists in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME). According to Cisco's security advisory, published on November 4, 2026, the flaw could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.

This security issue stems from improper validation of user-supplied input in the web interface. An attacker could exploit this vulnerability by persuading a user to click a specially crafted link. A successful exploit could enable the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Affected Products

At the time of publication, the vulnerability affected both Cisco Unified CM and Cisco Unified CM SME, regardless of device configuration. The advisory provides specific information about which software releases were vulnerable and which include the fix. For releases 14, Cisco recommends migrating to a fixed release, while for release 15, the fix is available in version 15SU5.

No Workarounds Available

Cisco has emphasized that there are no workarounds that address this vulnerability. The company considers any temporary solutions as insufficient protection until an upgrade to a fixed software release is available. This leaves affected organizations with no alternative but to apply the security updates.

Cisco's Response

Cisco has released software updates that address this vulnerability and strongly recommends that customers upgrade to the fixed software indicated in the advisory. The fix for release 15 is also included as part of broader hardening improvements disclosed in Cisco's October 2026 security advisory for unified communications products.

The Cisco Product Security Incident Response Team (PSIRT) is not currently aware of any public announcements or malicious use of this vulnerability. The company thanked an external researcher for reporting the issue.

Customer Guidance

Customers can obtain software upgrades through the Cisco Support and Downloads page or by contacting the Cisco Technical Assistance Center (TAC) if they purchased through third-party vendors. When requesting upgrades, customers should have their product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.

Before upgrading, customers should ensure their devices have sufficient memory and verify that current hardware and software configurations will continue to be supported by the new release. For unclear information, customers are advised to contact Cisco TAC or their contracted maintenance providers.