Cisco Unified Intelligence Center CVE-2026-20327

Exploitation requires valid user credentials on the affected Cisco Unified Intelligence Center device, corresponding to PR:L in the CVSS vector. The attack is delivered over the network (AV:N) via crafted HTTP requests to the web-based management interface - no physical or local system access is needed beyond holding a valid account. No non-default configuration is required; any network-reachable deployment where the attacker has a valid account is vulnerable. The primary limiting factor is the authentication prerequisite: unauthenticated external attackers cannot exploit this vulnerability without first obtaining valid credentials through credential theft, phishing, or social engineering. The blind nature of the injection adds practical iteration overhead, limiting automation compared to error-based or UNION-based SQLi.

The CVSS 6.5 Medium score reflects network accessibility (AV:N) and high confidentiality impact (C:H), appropriately reduced by the PR:L authentication requirement. No EPSS score was provided, and given the authenticated barrier and enterprise-specific deployment context, opportunistic mass exploitation is unlikely. The absence of a CISA KEV listing and no public POC further support a lower immediate urgency. Notably, the description describes an 'authenticated, local attacker' while the CVSS vector uses AV:N - in Cisco advisory convention, 'local' refers to holding local account credentials on the device, not physical local access, which aligns with PR:L and the network attack vector; no conflict exists here. Real-world risk centers on insider threat or compromised accounts - an attacker must already possess valid credentials, making this a post-compromise data exfiltration vector rather than an initial access vector. The blind injection technique adds practical friction relative to what AC:L might suggest for automated tooling.

An attacker with valid low-privilege credentials sends crafted HTTP requests containing SQL injection payloads to the Cisco Unified Intelligence Center web management interface. Using blind SQL injection techniques - boolean-based conditionals or time delays - the attacker iterates queries to enumerate table structures and extract the internal database contents, potentially exposing contact center configuration data, user credentials, or operational records. No public POC has been identified at time of analysis, but standard blind SQLi tooling such as sqlmap would be applicable given sufficient authentication.