Open Redirect CVE-2026-20060

We are to synthesize data from multiple sources about CVE-2026-20060 into a comprehensive analysis. Return a JSON object.

We need to follow all instructions strictly.

First, understand the CVE data:

• CVE ID: CVE-2026-20060
• Description: A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of HTTP request parameters. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious web page.
• CVSS Score: 4.7
• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
• CWE: CWE-601 (URL Redirection to Untrusted Site ('Open Redirect'))
• EPSS Score: 0.02% (percentile 5%)
• Reported by: cisco
• CPE: cpe:2.3:a:cisco:cisco_unity_connection:*:*:*:*:*:*:*:* (this is a wildcard version, meaning all versions? But EUVD gives specific versions)
• Tags: Open Redirect, Cisco, Cisco Unity Connection
• SSVC: Exploitation: none, Automatable: no, Technical Impact: partial
• References: Cisco advisory, vuldb (advisory), NVD
• EUVD EUVD-2026-22953: affected versions listed.

Now, build the JSON fields.

product_name: "1-3 words ONLY. The specific product or service name affected." This is Cisco Unity Connection. So "Cisco Unity Connection". That's 3 words.

summary: 2-3 sentence plain-language summary for security professionals. Start with specific impact verb and product. "Remote attackers can redirect users to malicious web pages via open redirect in Cisco Unity Connection's web management interface." The CVSS shows AV:N, PR:N, UI:R, so unauthenticated remote, requires user interaction. Mention that it's an open redirect (CWE-601). Actively exploited? KEV not mentioned in input, no KEV field in input data, but we have SSVC exploitation: none. So not actively exploited. EPSS is low (0.02%, 5th percentile)