EUVD-2026-22951
GHSA-83qv-c52p-jx5j
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a reflected XSS attack against a user of the interface.
This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
AnalysisAI
Cross-site scripting (XSS) in Cisco Unity Connection's web-based management interface enables unauthenticated remote attackers to execute arbitrary script code in a victim's browser context by tricking them into clicking a crafted link. This reflected XSS vulnerability (CVE-2026-20059, CVSS 6.1) affects multiple 14.x and 15.x SU releases, requiring user interaction to exploit. While no active exploitation or public exploit code has been identified, the EPSS score of 0.04% indicates a very low likelihood of widespread attacks.
More in Cisco Unity Connection
View allRemote code execution in Cisco Unity Connection allows authenticated remote attackers with low-privilege credentials to
Server-Side Request Forgery (SSRF) in Cisco Unity Connection Web Inbox allows remote unauthenticated attackers to send a
Arbitrary file download in Cisco Unity Connection allows authenticated, remote attackers with administrative credentials
File disclosure vulnerability in Cisco Unity Connection's web-based management interface allows authenticated attackers
We are to synthesize data from multiple sources about CVE-2026-20060 into a comprehensive analysis. Return a JSON object
Authenticated SQL injection in Cisco Unity Connection allows attackers with valid user credentials to view arbitrary dat
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today