Riskcovery

CVE-2026-76438

Cisco BroadWorks CommPilot Application Software Authorization Bypass Vulnerability

State
Published
Severity
6.5 Medium
Published
Sep 16, 2026
Updated
Sep 17, 2026
Reserved
Aug 19, 2026

Read the record on cve.org

Description

A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker with low privileges to alter configurations on an affected device.

This vulnerability is due to missing authorization checks. An attacker could exploit this vulnerability by sending a crafted HTTP request. A successful exploit could allow the attacker to alter configurations on select pages.

Scores

CVSSScoreVectorSource
3.16.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:Ncisco

Weaknesses

Affected Products

ProductVersions
Cisco BroadWorksCisco
  • 22.0 ap347303Affected
  • 22.0Affected
  • 24.0 ap374691Affected
  • 24.0 ap379346Affected
  • 24.0 ap377723Affected
  • 24.0 ap376842Affected
  • 24.0 ap374270Affected
  • 24.0 ap378218Affected
  • 24.0 ap376702Affected
  • 24.0 ap376000Affected
  • 24.0 ap378506Affected
  • 24.0 ap375018Affected
  • 24.0 ap377497Affected
  • 24.0 ap375959Affected
  • 24.0 ap379438Affected
  • 24.0 ap379016Affected
  • 24.0 ap378995Affected
  • 24.0 ap377412Affected
  • 24.0 ap378258Affected
  • 24.0 ap375711Affected
  • 24.0 ap378574Affected
  • 24.0 ap376809Affected
  • 24.0 ap375488Affected
  • 24.0 ap377555Affected
  • 24.0 ap375646Affected
  • and 7964 more versions

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.