Cisco Unity Connection
Monthly
Remote code execution in Cisco Unity Connection allows authenticated remote attackers with low-privilege credentials to execute arbitrary code as root via crafted API requests to the web management interface. Successful exploitation enables complete device compromise. CVSS score of 8.8 reflects high impact across confidentiality, integrity, and availability, though exploitation requires valid user credentials (PR:L). No public exploit code or active exploitation confirmed at time of analysis. EPSS data not available in provided intelligence.
Server-Side Request Forgery (SSRF) in Cisco Unity Connection Web Inbox allows remote unauthenticated attackers to send arbitrary network requests sourced from the vulnerable server. The vulnerability affects the web UI component and requires no authentication, privileges, or user interaction (CVSS AV:N/AC:L/PR:N/UI:N), enabling attackers to abuse the server's network position for internal network reconnaissance, service enumeration, or attacks against backend systems. The changed scope (S:C) indicates impact extends beyond the vulnerable component to other network resources accessible from the Unity Connection server.
Cross-site scripting (XSS) in Cisco Unity Connection's web-based management interface enables unauthenticated remote attackers to execute arbitrary script code in a victim's browser context by tricking them into clicking a crafted link. This reflected XSS vulnerability (CVE-2026-20059, CVSS 6.1) affects multiple 14.x and 15.x SU releases, requiring user interaction to exploit. While no active exploitation or public exploit code has been identified, the EPSS score of 0.04% indicates a very low likelihood of widespread attacks.
Authenticated SQL injection in Cisco Unity Connection allows attackers with valid user credentials to view arbitrary data from the backend database via the web management interface. The vulnerability requires low privileges and leads to low confidentiality impact, with no integrity or availability compromise. No public exploit or active exploitation has been reported at time of analysis, and EPSS scores indicate low exploitation probability.
We are to synthesize data from multiple sources about CVE-2026-20060 into a comprehensive analysis. Return a JSON object. We need to follow all instructions strictly. First, understand the CVE data: - CVE ID: CVE-2026-20060 - Description: A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of HTTP request parameters. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious web page. - CVSS Score: 4.7 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N - CWE: CWE-601 (URL Redirection to Untrusted Site ('Open Redirect')) - EPSS Score: 0.02% (percentile 5%) - Reported by: cisco - CPE: cpe:2.3:a:cisco:cisco_unity_connection:*:*:*:*:*:*:*:* (this is a wildcard version, meaning all versions? But EUVD gives specific versions) - Tags: Open Redirect, Cisco, Cisco Unity Connection - SSVC: Exploitation: none, Automatable: no, Technical Impact: partial - References: Cisco advisory, vuldb (advisory), NVD - EUVD EUVD-2026-22953: affected versions listed. Now, build the JSON fields. product_name: "1-3 words ONLY. The specific product or service name affected." This is Cisco Unity Connection. So "Cisco Unity Connection". That's 3 words. summary: 2-3 sentence plain-language summary for security professionals. Start with specific impact verb and product. "Remote attackers can redirect users to malicious web pages via open redirect in Cisco Unity Connection's web management interface." The CVSS shows AV:N, PR:N, UI:R, so unauthenticated remote, requires user interaction. Mention that it's an open redirect (CWE-601). Actively exploited? KEV not mentioned in input, no KEV field in input data, but we have SSVC exploitation: none. So not actively exploited. EPSS is low (0.02%, 5th percentile)
Arbitrary file download in Cisco Unity Connection allows authenticated, remote attackers with administrative credentials to exfiltrate system files via crafted HTTPS requests. The flaw stems from improper input sanitization (CWE-23) in the web-based management interface. No active exploitation or public proof-of-concept is known, and EPSS (0.08%) indicates low exploitation likelihood, making this a moderate priority for patching in environments where the management interface is already adequately protected.
File disclosure vulnerability in Cisco Unity Connection's web-based management interface allows authenticated attackers with administrative credentials to download arbitrary files via crafted HTTPS requests. The flaw stems from improper sanitization of user input leading to relative path
Remote code execution in Cisco Unity Connection allows authenticated remote attackers with low-privilege credentials to execute arbitrary code as root via crafted API requests to the web management interface. Successful exploitation enables complete device compromise. CVSS score of 8.8 reflects high impact across confidentiality, integrity, and availability, though exploitation requires valid user credentials (PR:L). No public exploit code or active exploitation confirmed at time of analysis. EPSS data not available in provided intelligence.
Server-Side Request Forgery (SSRF) in Cisco Unity Connection Web Inbox allows remote unauthenticated attackers to send arbitrary network requests sourced from the vulnerable server. The vulnerability affects the web UI component and requires no authentication, privileges, or user interaction (CVSS AV:N/AC:L/PR:N/UI:N), enabling attackers to abuse the server's network position for internal network reconnaissance, service enumeration, or attacks against backend systems. The changed scope (S:C) indicates impact extends beyond the vulnerable component to other network resources accessible from the Unity Connection server.
Cross-site scripting (XSS) in Cisco Unity Connection's web-based management interface enables unauthenticated remote attackers to execute arbitrary script code in a victim's browser context by tricking them into clicking a crafted link. This reflected XSS vulnerability (CVE-2026-20059, CVSS 6.1) affects multiple 14.x and 15.x SU releases, requiring user interaction to exploit. While no active exploitation or public exploit code has been identified, the EPSS score of 0.04% indicates a very low likelihood of widespread attacks.
Authenticated SQL injection in Cisco Unity Connection allows attackers with valid user credentials to view arbitrary data from the backend database via the web management interface. The vulnerability requires low privileges and leads to low confidentiality impact, with no integrity or availability compromise. No public exploit or active exploitation has been reported at time of analysis, and EPSS scores indicate low exploitation probability.
We are to synthesize data from multiple sources about CVE-2026-20060 into a comprehensive analysis. Return a JSON object. We need to follow all instructions strictly. First, understand the CVE data: - CVE ID: CVE-2026-20060 - Description: A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of HTTP request parameters. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious web page. - CVSS Score: 4.7 - CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N - CWE: CWE-601 (URL Redirection to Untrusted Site ('Open Redirect')) - EPSS Score: 0.02% (percentile 5%) - Reported by: cisco - CPE: cpe:2.3:a:cisco:cisco_unity_connection:*:*:*:*:*:*:*:* (this is a wildcard version, meaning all versions? But EUVD gives specific versions) - Tags: Open Redirect, Cisco, Cisco Unity Connection - SSVC: Exploitation: none, Automatable: no, Technical Impact: partial - References: Cisco advisory, vuldb (advisory), NVD - EUVD EUVD-2026-22953: affected versions listed. Now, build the JSON fields. product_name: "1-3 words ONLY. The specific product or service name affected." This is Cisco Unity Connection. So "Cisco Unity Connection". That's 3 words. summary: 2-3 sentence plain-language summary for security professionals. Start with specific impact verb and product. "Remote attackers can redirect users to malicious web pages via open redirect in Cisco Unity Connection's web management interface." The CVSS shows AV:N, PR:N, UI:R, so unauthenticated remote, requires user interaction. Mention that it's an open redirect (CWE-601). Actively exploited? KEV not mentioned in input, no KEV field in input data, but we have SSVC exploitation: none. So not actively exploited. EPSS is low (0.02%, 5th percentile)
Arbitrary file download in Cisco Unity Connection allows authenticated, remote attackers with administrative credentials to exfiltrate system files via crafted HTTPS requests. The flaw stems from improper input sanitization (CWE-23) in the web-based management interface. No active exploitation or public proof-of-concept is known, and EPSS (0.08%) indicates low exploitation likelihood, making this a moderate priority for patching in environments where the management interface is already adequately protected.
File disclosure vulnerability in Cisco Unity Connection's web-based management interface allows authenticated attackers with administrative credentials to download arbitrary files via crafted HTTPS requests. The flaw stems from improper sanitization of user input leading to relative path