# Multiple Vulnerabilities in Cisco Products (ISE, ISE-PIC, UCS Central, Unified CM/SME) - CVE-2026-20241, CVE-2026-76419, CVE-2026-76506

> Cisco disclosed three vulnerabilities on 4 Nov 2026 affecting Identity Services Engine/ISE-PIC (unauthenticated authorization bypass), UCS Central Software (authenticated RCE, CVSS 7.6) and Unified CM/SME (reflected XSS). Fixed software is available and Cisco PSIRT reports no public announcements or malicious use.

- **Published:** 2026-11-06T18:14:04Z
- **Last reviewed:** 2026-11-06T18:14:04Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5437
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5437.png
- **ID:** TL-2026-5437
- **Severity:** HIGH (CVSS 7.6)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 12 (3 shown free below)
- **CVEs:** CVE-2026-20241, CVE-2026-76419, CVE-2026-76506

## Description

GovCERT.HK alert A26-11-07 (5 Nov 2026) relays three Cisco security advisories published on 4 Nov 2026. Depending on the flaw, impact ranges from remote code execution to information disclosure and security restriction bypass.

CVE-2026-76506 (cisco-sa-cucs-rce-LzHSFRDQ, CVSS 7.6 High, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, CWE-22) is a flaw in the web management interface of Cisco UCS Central Software. Insufficient input validation of HTTP requests lets an authenticated attacker with valid credentials execute arbitrary code or access sensitive data. No workarounds exist. Releases 2.0 and earlier are vulnerable and must migrate to a fixed release; release 2.1 is fixed in 2.1(2c). The issue was reported by Anand Murugan of Gulf Business Machines (GBM).

CVE-2026-20241 (cisco-sa-ise-cert-mE9BD5GO, CVSS 5.3 Medium, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, CWE-285) is an authorization flaw in Cisco ISE and ISE-PIC that lets an unauthenticated remote attacker obtain an endpoint identity certificate through crafted requests. Fixed in 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7 and 3.5 Patch 4. No workarounds.

CVE-2026-76419 (cisco-sa-cucm-xss-5mQn2U5z, CVSS 6.1 Medium, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, CWE-79) is a cross-site scripting flaw in the web-based management interface of Cisco Unified CM and Unified CM SME releases 14 and 15. An unauthenticated attacker can persuade a user of the interface to click a crafted link and execute script in the interface context or access sensitive browser-based information. Release 14 must migrate to a fixed release; release 15 is fixed in 15SU5 and later. No workarounds.

Per Cisco, PSIRT is not aware of public announcements or malicious use of any of the three issues. No network or file IOCs have been published; the indicators recorded here are advisory, product and URL identifiers for tracking and patch-compliance purposes. The overall record severity follows the highest-rated CVE (CVE-2026-76506, 7.6).

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566.002 Spearphishing Link
- T1078 Valid Accounts
- T1203 Exploitation for Client Execution
- T1059.007 JavaScript
- T1204.001 Malicious Link
- T1649 Steal or Forge Authentication Certificates
- T1005 Data from Local System

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Unified CM Management URL XSS Payload (CVE-2026-76419) - Client-Side Exploitation / Lure** (`TL-2026-5437-SPL-003`)

Splunk SPL detection for CVE-2026-76419 on Cisco Unified CM / SME. Cisco PSIRT reports no known exploitation at publication (2026-11-04); this is behavioural coverage of the advisory's described trigger, not a known exploit signature.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.002, T1204.001, T1059.007, T1203
- **Data sources:** cisco_cucm_web_access_logs, reverse_proxy_or_waf_access_logs, defender_for_office365_urlclickevents
- **Severity:** medium
- **Confidence:** medium

### Splunk SPL

````spl
index=network sourcetype=access_combined (host=cucm* OR dest=cucm*) ```CVE-2026-76419 cisco-sa-cucm-xss-5mQn2U5z reflected XSS via crafted link to Unified CM web management interface``` (uri_path="/ccmadmin/*" OR uri_path="/ccmservice/*" OR uri_path="/cmplatform/*" OR uri_path="/ccmuser/*") (uri_query="*<script*" OR uri_query="*%3cscript*" OR uri_query="*javascript:*" OR uri_query="*onerror=*" OR uri_query="*onload=*" OR uri_query="*%3csvg*") | stats count values(uri_path) as paths values(http_referrer) as referrers min(_time) as first_seen max(_time) as last_seen by src_ip, user, dest | eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T") | sort - count
````

### Microsoft KQL

```kql
// CVE-2026-76419 - crafted XSS link to Unified CM / SME web management interface clicked by a user
UrlClickEvents
| where Timestamp > ago(24h)
| where Url has_any ("/ccmadmin/", "/ccmservice/", "/cmplatform/", "/ccmuser/")
| where Url has_any ("<script", "%3cscript", "javascript:", "onerror=", "onload=", "%3csvg")
| project Timestamp, AccountUpn, Url, IPAddress, ActionType, IsClickedThrough, NetworkMessageId
| order by Timestamp desc
```

### Sigma

```yaml
title: Cisco Unified CM Reflected XSS Payload in Management URL (CVE-2026-76419)
id: d41a9e85-67c3-4b0f-8e12-c5f3a7b90d36
status: experimental
description: Detects script-injection payloads in query strings sent to Cisco Unified CM / SME web management paths, consistent with a crafted link exploiting CVE-2026-76419.
references:
  - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-xss-5mQn2U5z
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
  - attack.initial-access
  - attack.t1566.002
  - attack.execution
  - attack.t1204.001
  - attack.t1059.007
  - attack.t1203
  - cve.2026.76419
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/ccmadmin/'
      - '/ccmservice/'
      - '/cmplatform/'
      - '/ccmuser/'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - '%3cscript'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - '%3csvg'
  condition: selection_path and selection_payload
falsepositives:
  - Internal web application security testing against Unified CM
  - Rare legitimate parameters containing the string onload=
level: high

```

**Known false positives:**

- Internal application security testing of Unified CM
- Rare legitimate parameters containing onload= or javascript: strings

**Tuning notes:** Replace host=cucm* with Unified CM publisher and subscriber names, add payload strings seen in your environment, and prioritise hits whose referrer is an external or mail domain. For KQL, ensure Safe Links click telemetry is enabled.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ISE Unauthenticated Endpoint Certificate Request (CVE-2026-20241) - Exploitation (locked: unlock with TL Creds)
- UCS Central Authenticated Traversal Request (CVE-2026-76506) - Post-Authentication Exploitation (locked: unlock with TL Creds)
- Unified CM Management URL XSS Payload (CVE-2026-76419) - Client-Side Exploitation / Lure (locked: unlock with TL Creds)
- ISE Unauthenticated Endpoint Certificate Request (CVE-2026-20241) - Exploitation (locked: unlock with TL Creds)
- UCS Central Authenticated Traversal Request (CVE-2026-76506) - Post-Authentication Exploitation (locked: unlock with TL Creds)
- Unified CM Management URL XSS Payload (CVE-2026-76419) - Client-Side Exploitation / Lure (locked: unlock with TL Creds)
- ISE Unauthenticated Endpoint Certificate Request (CVE-2026-20241) - Exploitation (locked: unlock with TL Creds)
- UCS Central Authenticated Traversal Request (CVE-2026-76506) - Post-Authentication Exploitation (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 12)

Defanged, TLP:CLEAR.

- URL: `hxxps://sec[.]cloudapps[.]cisco[.]com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucs-rce-LzHSFRDQ`
- URL: `hxxps://sec[.]cloudapps[.]cisco[.]com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-cert-mE9BD5GO`
- URL: `hxxps://sec[.]cloudapps[.]cisco[.]com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-xss-5mQn2U5z`

Full set of 12 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [GovCERT.HK Alert A26-11-07: Multiple Vulnerabilities in Cisco Products](https://www.govcert.gov.hk/en/alerts_detail.php?id=2162)
- [Cisco UCS Central Software Remote Code Execution Vulnerability (CVE-2026-76506)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucs-rce-LzHSFRDQ)
- [Cisco Identity Services Engine Authorization Bypass Vulnerability (CVE-2026-20241)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-cert-mE9BD5GO)
- [Cisco Unified Communications Manager Cross-Site Scripting Vulnerability (CVE-2026-76419)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-xss-5mQn2U5z)
- [CWE-22: Improper Limitation of a Pathname to a Restricted Directory](https://cwe.mitre.org/data/definitions/22.html)
- [CWE-285: Improper Authorization](https://cwe.mitre.org/data/definitions/285.html)
- [CWE-79: Improper Neutralization of Input During Web Page Generation](https://cwe.mitre.org/data/definitions/79.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5437