CVE-2026-76438— Cisco BroadWorks CommPilot Application Software Authorization Bypass Vulnerability
Quick assessment
Affected
Cisco Cisco BroadWorks
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker with low privileges to alter configurations on an affected device. This vulnerability is due to missing autho
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-76438
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cisco BroadWorks CommPilot Application Software Authorization Bypass Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker with low privileges to alter configurations on an affected device.
This vulnerability is due to missing authorization checks. An attacker could exploit this vulnerability by sending a crafted HTTP request. A successful exploit could allow the attacker to alter configurations on select pages.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Cisco | Cisco BroadWorks | 22.0 ap347303 | - |
|
II. Public POCs for CVE-2026-76438
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-76438
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-76438 (1)
Same Patch Batch · Cisco · 2026-09-16 · 79 CVEs total
| CVE-2026-20192 | 10.0 CRITICAL | Cisco Identity Services Engine Hardening Release - Access Control Vulnerabilities |
| CVE-2026-76460 | 10.0 CRITICAL | Cisco Identity Services Engine Authentication Bypass Vulnerability |
| CVE-2026-76423 | 10.0 CRITICAL | Cisco ISE API Authentication Bypass Vulnerability |
| CVE-2026-20130 | 10.0 CRITICAL | Cisco Identity Services Engine Hardening Release - Improper Neutralization Vulnerabilities |
| CVE-2026-20332 | 9.9 CRITICAL | Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software |
| CVE-2026-20307 | 9.9 CRITICAL | Cisco Identity Services Engine Remote Code Execution Vulnerability |
| CVE-2026-20234 | 9.9 CRITICAL | Cisco Identity Services Engine Hardening Release - Insuffiencently Protected Credential Vu |
| CVE-2026-20324 | 9.9 CRITICAL | Cisco Secure Firewall Management Center sftunnel Root Arbitrary Code Exectution Vulnerabil |
| CVE-2026-20325 | 9.9 CRITICAL | Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Improper Neutra |
| CVE-2026-20329 | 9.9 CRITICAL | Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software |
| CVE-2026-20322 | 9.9 CRITICAL | Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Improper Access |
| CVE-2026-20330 | 9.9 CRITICAL | Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software |
| CVE-2026-20242 | 9.8 CRITICAL | Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Executio |
| CVE-2026-20326 | 9.8 CRITICAL | Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Missing Authent |
| CVE-2026-20331 | 9.6 CRITICAL | Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software |
| CVE-2026-20306 | 9.1 CRITICAL | Cisco Identity Services Engine Command Injection Vulnerability |
| CVE-2026-20211 | 9.1 CRITICAL | Cisco Identity Services Engine Remote Code Execution Vulnerability |
| CVE-2026-20341 | 9.1 CRITICAL | Cisco Secure Firewall Management Center Software sftunnel Deserialization Root Command Exe |
| CVE-2026-20176 | 9.1 CRITICAL | Cisco Identity Services Engine Remote Code Execution Vulnerability |
| CVE-2026-20284 | 9.1 CRITICAL | Cisco Identity Search Engine SXP REST API SQL Injection Vulnerability |
Showing top 20 of 79 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Cisco BroadWorks
-
CVE-2026-20320
Cisco BroadWorks 输入验证错误漏洞 -
CVE-2025-20307
Cisco BroadWorks Application Delivery Platform Cross-Site Sc -
CVE-2025-20211
Cisco BroadWorks Application Delivery Platform Software Cros -
CVE-2025-20165
Cisco BroadWorks SIP Denial of Service Vulnerability -
CVE-2022-20948
Cisco BroadWorks Hosted Thin Receptionist Cross-Site Scripti
Same vendor: Cisco
-
CVE-2026-76426
Cisco ISE REST API SQL Injection Vulnerability -
CVE-2026-20121
CIsco FTD Bypass Access List -
CVE-2026-76431
Cisco Identity Services Engine Arbitrary File Deletion Vulne -
CVE-2026-76427
Cisco ISE XML External Entity Injection Vulnerability -
CVE-2026-76447
Cisco Identity Services Engine Certificate Reload Vulnerabil
Same weakness: CWE-863
-
CVE-2026-92801
cc-connect through 1.5.0 User Allowlist Bypass via Feishu Ca -
CVE-2026-92796
Manticore Search 27.0.0 before 28.4.4 Multi-Statement Author -
CVE-2026-92793
GoAdmin through 1.2.26 Authorization Bypass via Query Parame -
CVE-2026-92788
Coze Studio through 0.5.1 Cross-Tenant Database Access via W -
CVE-2026-92782
Chroma through 1.5.9 Authorization Bypass via Collection Ide
V. Comments for CVE-2026-76438
No comments yet