CVE Intelligence
Medium Access control

CVE-2026-76438 — Cisco BroadWorks CommPilot Application Software Authorization Bypass Vulnerability

A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker with low privileges to alter configurations on an affected device. This vulnerability is due to missing authorization checks. An attacker could exploit this vulnerability by sending a crafted HTTP request. A successful exploit could allow the attacker to alter configurations on select pages.

Published Sep 16, 2026 · Updated Oct 15, 2026 · Sources: NIST National Vulnerability Database, CVE Program (cve.org) e CISA ADP · CNA: cisco

Who exploits it and how urgent it is

A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.

No exploitation signal in the sources consulted so far.
How the score was calculated
  • EPSS 0.6% (30-day exploitation probability)+7
  • Technical severity (medium)+3

The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.

Exploitation
Not confirmed
Not in CISA KEV — an absence of record, not proof it is unexploited.
EPSS FIRST
0.56%
ahead of 45% of scored CVEs · Oct 15, 2026
Affects
Cisco
Broadworks
CVSS base
6.5
Medium · 2 source(s)

CISA SSVC assessment CISA

Three decision points CISA publishes for the CVEs it assesses (SSVC 2.0.3). A stakeholder decision, not a severity score.

Exploitation
None
none · proof-of-concept · active
Automatable
No
can an attacker script the kill-chain steps
Technical impact
Partial
partial · total control of the vulnerable component

Remediation

Fixes and mitigations documented by the sources — linked to the original advisory.

No fix documented by the sources we poll. That does not mean none exists: check the vendor advisory.

First 24 hours

Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.

  1. Identify exposed assets running the affected vendor/product/version combinations (Cisco Broadworks).
  2. No fix documented in the sources: reduce exposure and monitor the vendor advisory.
  3. Search available logs for exploit probes matching the vulnerability class (access control), errors and authentication anomalies.

Affected scope

Vendor, product and versions as the sources word them.

VendorProductVersionsStatusSource
Cisco Broadworks version 24.0 ap385749version RI.2026.08version 24.0 ap385766version 24.0 ap385768version RI.2026.07version RI.2026.06version RI.2026.05version 24.0 ap385755
and 292 more version 24.0 ap385754version 24.0 ap385738version RI.2026.04version 24.0 ap385747version 24.0 ap385746version RI.2026.03version RI.2026.02version 24.0 ap385741version 24.0 ap385740version 24.0 ap385427version 24.0 ap385426version 24.0 ap385403version 23.0 ap385427version 24.0 ap385434version 24.0 ap385433version 24.0 ap385431version 23.0 ap385437version 24.0 ap385439version 24.0 ap385440version 24.0 ap385437version 23.0 ap385444version 24.0 ap385438version 24.0 ap385444version 24.0 ap385442version 24.0 ap385446version 23.0 ap385442version RI.2023.12version 23.0 ap385441version 23.0 ap385424version 24.0 ap385441version 24.0 ap385424version 24.0 ap385453version 24.0 ap385454version 24.0 ap385450version 23.0 ap385453version 24.0 ap385456version RI.2024.01version 24.0 ap385457version 24.0 ap385464version 24.0 ap385458version 24.0 ap385463version 24.0 ap385461version 24.0 ap385462version 23.0 ap385463version 23.0 ap385457version 23.0 ap385458version 23.0 ap385462version 24.0 ap385469version 24.0 ap385455version 24.0 ap385473version 24.0 ap385471version 23.0 ap385471version 23.0 ap385472version 23.0 ap385459version 24.0 ap385459version 24.0 ap385472version 24.0 ap385474version RI.2024.02version 24.0 ap385476version 24.0 ap385478version 24.0 ap385475version 24.0 ap385486version 24.0 ap385484version 23.0 ap385475version 24.0 ap385491version 24.0 ap385489version 24.0 ap385493version 24.0 ap385490version 24.0 ap385487version 24.0 ap385496version RI.2024.03version 23.0 ap385487version 23.0 ap385489version 24.0 ap385501version 24.0 ap385497version 24.0 ap385502version 23.0 ap385497version 23.0 ap385500version 23.0 ap385507version 24.0 ap385507version 24.0 ap385500version 24.0 ap385488version RI.2024.04version 24.0 ap385510version 24.0 ap385503version 24.0 ap385515version 24.0 ap385518version 23.0 ap385518version 24.0 ap385509version 24.0 ap385517version 24.0 ap385519version 24.0 ap385514version 23.0 ap385519version 23.0 ap385134version 23.0 ap385517version 24.0 ap385525version 24.0 ap385520version 24.0 ap385524version 24.0 ap385511version 23.0 ap385521version 23.0 ap385520version 24.0 ap385526version 23.0 ap385526version RI.2024.05version 23.0 ap385378version 24.0 ap385527version 24.0 ap385528version 24.0 ap385529version 23.0 ap385530version 24.0 ap385530version 24.0 ap385531version 24.0 ap385534version 23.0 ap385528version 23.0 ap385539version 24.0 ap385539version 24.0 ap385538version 24.0 ap385541version 23.0 ap385450version 23.0 ap385538version RI.2024.06version 24.0 ap385535version 24.0 ap385552version 24.0 ap385545version 24.0 ap385553version 24.0 ap385542version 24.0 ap385549version 24.0 ap385557version 24.0 ap385555version 21.sp1 ap355637version 21.sp1 ap356474version 21.0 ap365886version 21.0 ap340749version 21.sp1 ap350141version 21.sp1 ap352357version 21.0 ap344150version 21.0 ap355897version 21.0 ap342284version 21.sp1 ap355912version 21.0 ap241133version 21.sp1 ap351365version 21.0 ap339109version 21.0 ap247376version 21.sp1 ap367547version 21.sp1 ap342706version 21.sp1 ap343410version 21.0 ap358289version 21.sp1 ap365379version 21.sp1 ap344467version 21.sp1 ap373197version 21.0 ap350603version 21.sp1 ap346128version 21.sp1 ap366290version 21.0 ap341586version 21.sp1 ap346512version 21.0 ap350564version 21.0 ap347258version 21.0 ap362825version 21.sp1 ap361651version 21.0 ap342776version 21.sp1 ap362848version 21.0 ap225333version 21.sp1 ap375355version 21.sp1 ap349745version 21.sp1 ap349664version 21.sp1 ap349872version 21.0 ap354314version 21.sp1 ap344114version 21.0 ap361643version 21.sp1 ap347277version 21.0 ap341658version 21.0 ap359121version 21.0 ap345738version 21.0 ap356817version 21.sp1 ap339223version 21.sp1 ap342719version 21.sp1 ap345873version 21.0 ap344403version 21.sp1 ap342188version 21.sp1 ap356787version 21.sp1 ap338839version 21.0 ap348473version 21.sp1 ap351961version 21.sp1 ap350218version 21.0 ap357366version 21.0 ap355356version 21.sp1 ap359808version 21.0 ap351165version 21.sp1 ap349236version 21.0 ap359118version 21.0 ap346640version 21.sp1 ap376308version 21.0 ap351639version 21.0 ap344725version 21.0 ap346235version 21.sp1 ap357802version 21.sp1 ap378029version 21.0 ap363233version 21.sp1 ap247376version 21.sp1 ap365900version 21.0 ap365060version 21.sp1 ap350179version 21.sp1 ap343782version 21.sp1 ap351497version 21.0 ap344679version 21.sp1 ap341586version 21.0 ap339449version 21.sp1 ap351200version 21.0 ap343572version 21.sp1 ap352205version 21.sp1 ap353403version 21.sp1 ap339658version 21.sp1 ap350564version 21.0 ap348753version 21.0 ap343924version 21.sp1 ap358132version 21.0 ap348334version 21.sp1 ap342473version 21.sp1 ap343452version 21.sp1 ap364369version 21.0 ap359657version 21.sp1 ap349996version 21.sp1 ap367340version 21.sp1 ap352726version 21.0 ap346009version 21.0 ap343999version 21.0 ap342546version 21.sp1 ap354412version 21.sp1 ap345732version 21.sp1 ap370388version 21.0 ap354469version 21.sp1 ap346233version 21.0 ap350497version 21.sp1 ap366747version 21.0 ap351223version 21.sp1 ap363694version 21.sp1 ap248266version 23.0 ap385314version 23.0 ap385283version 24.0 ap385314version 24.0 ap385310version 24.0 ap385283version 23.0 ap385317version 23.0 ap385274version 24.0 ap385312version 24.0 ap385317version 24.0 ap385315version 23.0 ap385316version 24.0 ap385322version 24.0 ap385324version 24.0 ap385316version 24.0 ap385323version 24.0 ap385326version 23.0 ap385336version 23.0 ap385334version 24.0 ap385336version 24.0 ap385334version RI.2023.07version 24.0 ap385338version 24.0 ap385337version 24.0 ap385329version 24.0 ap385342version 24.0 ap385339version 23.0 ap385329version 23.0 ap385337version 23.0 ap385342version 23.0 ap385341version 24.0 ap385344version 24.0 ap385340version 24.0 ap385348version 23.0 ap385344version 23.0 ap385346version 24.0 ap385351version 23.0 ap385351version 24.0 ap385353version RI.2023.08version 24.0 ap385354version 24.0 ap385345version 24.0 ap385355version 24.0 ap385356version 24.0 ap385360version 24.0 ap385349version 23.0 ap385355version 23.0 ap385354version 23.0 ap385360version 24.0 ap385361version 24.0 ap385363version 24.0 ap385364version 24.0 ap385333version 23.0 ap385363version 23.0 ap385333version 24.0 ap385370version 24.0 ap385365
Vulnerable CVE Program (cve.org) e CISA ADP

Attack characteristics

The CVSS vector, decoded. It describes the attack, not your exposure to it.

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Every base score collected

Sources score independently and may disagree; each row says who scored it and under which version.

ScoreVersionSeverityExpl.ImpactScored by
6.5 CVSS 3.1 Medium 2.8 3.6 psirt@cisco.com via NIST National Vulnerability Database
6.5 CVSS 3.1 Medium — — cisco via CVE Program (cve.org) e CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N (score shown at the top: psirt@cisco.com)

Weakness MITRE

Weakness class according to MITRE’s CWE catalog.

CWE-863 · Incorrect Authorization

Other CVEs with this weakness →

Detection

Read off the CVSS vector and the weakness class. Starting points, not tested rules.

  • Prioritize edge telemetry for the network-reachable component (proxy, WAF, IDS/IPS).
  • Audit administrative actions and access to resources outside each user’s normal pattern.
web/proxy/WAF logsnetwork IDS/IPSauthentication logsapplication logs

Timeline

What happened to this CVE, newest first.

  • 2026
  • Affected products added · cisco/cisco broadworks
    Oct 15, 2026 · CVE Program (cve.org) e CISA ADP
  • SSVC assessment updated
    Oct 15, 2026 · CVE Program (cve.org) e CISA ADP
  • Record published
    Oct 15, 2026
  • CVSS changed · 6.5
    Oct 15, 2026 · NIST National Vulnerability Database
  • Source status changed · → Awaiting Analysis
    Oct 15, 2026 · NIST National Vulnerability Database
  • Record created in this database
    Oct 15, 2026 · NIST National Vulnerability Database
  • CVE published
    Sep 16, 2026 · cisco

Source activity

Repeated readings are counted rather than listed.

  • 1× Official description updated · Oct 15, 2026 – Oct 15, 2026

References

1 on the record

Elsewhere on this site

Cisco
every CVE for this vendor
Access control
same class
CWE-863
other pages naming this weakness

Related CVEs (same products)

  • CVE-2026-20320 XML External Entity (XXE) in Cisco Broadworks Aug 19, 2026
  • CVE-2021-44228 Apache Log4j2 Remote Code Execution Vulnerability KEV Dec 10, 2021

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

  • No fixed version, patch or mitigation documented.
  • No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
  • No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
  • No exploit packet captures, log samples, or incident case IDs supplied.

Answered from this record

Text assembled only from the fields above — no additional claims.

What should defenders know first?

CVE-2026-76438 is "Cisco BroadWorks CommPilot Application Software Authorization Bypass Vulnerability", rated Medium. It affects Broadworks (Cisco); versions are in the scope table. It is not in CISA KEV, which does not rule out exploitation. CVSS 6.5 describes technical severity. EPSS 0.56% estimates the probability of exploitation in 30 days; neither replaces your asset context. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.

Comments

Moderated technical discussion. Read the community guidelines.

No comments yet.

Sign in or create an account to comment and suggest corrections.