Skip to content
TrackCVE
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2026-76438

Cisco BroadWorks CommPilot Application Software Authorization Bypass Vulnerability

Medium6.5EPSS 0.56%
Published
Updated
Reserved
Assigned by
cisco

Description

A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker with low privileges to alter configurations on an affected device. This vulnerability is due to missing authorization checks. An attacker could exploit this vulnerability by sending a crafted HTTP request. A successful exploit could allow the attacker to alter configurations on select pages.

Timeline

  1. ID reserved

    By cisco

  2. · 28 days later

    Published

  3. · 1 day later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-76438, by who scored it
Scored byCVSSScoreVector
ciscoCNA (assigner)3.1Medium6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NVDNVD · Awaiting Analysis3.1Medium6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS (exploitation in 30 days)
0.56% · top 53% of all CVEs (7 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.

Weakness

Affected products

  • Cisco · Cisco BroadWorks

    • affected 22.0 ap347303
    • affected 22.0
    • affected 24.0 ap374691
    • affected 24.0 ap379346
    • affected 24.0 ap377723
    • affected 24.0 ap376842
    • affected 24.0 ap374270
    • affected 24.0 ap378218
    • affected 24.0 ap376702
    • affected 24.0 ap376000
    • affected 24.0 ap378506
    • affected 24.0 ap375018
    • affected 24.0 ap377497
    • affected 24.0 ap375959
    • affected 24.0 ap379438
    • affected 24.0 ap379016
    • affected 24.0 ap378995
    • affected 24.0 ap377412
    • affected 24.0 ap378258
    • affected 24.0 ap375711
    • affected 24.0 ap378574
    • affected 24.0 ap376809
    • affected 24.0 ap375488
    • affected 24.0 ap377555
    • affected 24.0 ap375646
    • affected 24.0 ap375634
    • affected 24.0 ap378029
    • affected 24.0 ap379373
    • affected 24.0 ap375293
    • affected 24.0 ap378322
    • affected 24.0 ap378010
    • affected 24.0 ap375860
    • affected 24.0 ap376721
    • affected 24.0 ap378481
    • affected 24.0 ap377737
    • affected 24.0 ap378332
    • affected 24.0 ap378866
    • affected 24.0 ap377983
    • affected 24.0 ap379389
    • affected 24.0 ap378234
    • and 7949 more

What to do

Exploitation: The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-76438 badge
[![CVE-2026-76438](https://trackcve.app/badge/CVE-2026-76438.svg)](https://trackcve.app/cve/CVE-2026-76438)

Record last updated .