EUVD-2026-22957
GHSA-9p4v-rc38-f32h
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker to download arbitrary files from an affected system. To exploit these vulnerabilities, the attacker must have valid administrative credentials.
These vulnerabilities are due to improper sanitization of user input to the web-based management interface. An attacker could exploit these vulnerabilities by sending a crafted HTTPS request. A successful exploit could allow the attacker to download arbitrary files from an affected system.
AnalysisAI
Arbitrary file download in Cisco Unity Connection allows authenticated, remote attackers with administrative credentials to exfiltrate system files via crafted HTTPS requests. The flaw stems from improper input sanitization (CWE-23) in the web-based management interface. No active exploitation or public proof-of-concept is known, and EPSS (0.08%) indicates low exploitation likelihood, making this a moderate priority for patching in environments where the management interface is already adequately protected.
More in Cisco Unity Connection
View allRemote code execution in Cisco Unity Connection allows authenticated remote attackers with low-privilege credentials to
Server-Side Request Forgery (SSRF) in Cisco Unity Connection Web Inbox allows remote unauthenticated attackers to send a
File disclosure vulnerability in Cisco Unity Connection's web-based management interface allows authenticated attackers
Cross-site scripting (XSS) in Cisco Unity Connection's web-based management interface enables unauthenticated remote att
We are to synthesize data from multiple sources about CVE-2026-20060 into a comprehensive analysis. Return a JSON object
Authenticated SQL injection in Cisco Unity Connection allows attackers with valid user credentials to view arbitrary dat
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today