CVE-2026-20034
Full vulnerability record from the local CVENow database.
Description
A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of a targeted device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.
Severity
HIGH
CVSS score
8.8
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-05-06 17:16:20.093000
Last modified
2026-10-26 19:10:00.163000
View original CVE JSON
{
"id": "CVE-2026-20034",
"sourceIdentifier": "[email protected]",
"published": "2026-05-06T17:16:20.093",
"lastModified": "2026-10-26T19:10:00.163",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to execute arbitrary code on an affected device.\r\n\r\nThis vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of a targeted device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device."
},
{
"lang": "es",
"value": "Una vulnerabilidad en la interfaz de gestión basada en web de Cisco Unity Connection podría permitir a un atacante remoto autenticado ejecutar código arbitrario en un dispositivo afectado.\n\nEsta vulnerabilidad se debe a una validación insuficiente de la entrada proporcionada por el usuario. Un atacante podría explotar esta vulnerabilidad al enviar una solicitud de API manipulada. Un exploit exitoso podría permitir al atacante ejecutar código arbitrario como root, lo que posiblemente resultaría en el compromiso completo de un dispositivo objetivo. Para explotar esta vulnerabilidad, el atacante debe tener credenciales de usuario válidas en el dispositivo afectado."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Cisco",
"product": "Cisco Unity Connection",
"defaultStatus": "unknown",
"versions": [
{
"version": "12.5(1)",
"status": "affected"
},
{
"version": "12.5(1)SU1",
"status": "affected"
},
{
"version": "12.5(1)SU2",
"status": "affected"
},
{
"version": "12.5(1)SU3",
"status": "affected"
},
{
"version": "12.5(1)SU4",
"status": "affected"
},
{
"version": "14",
"status": "affected"
},
{
"version": "12.5(1)SU5",
"status": "affected"
},
{
"version": "14SU1",
"status": "affected"
},
{
"version": "12.5(1)SU6",
"status": "affected"
},
{
"version": "14SU2",
"status": "affected"
},
{
"version": "12.5(1)SU7",
"status": "affected"
},
{
"version": "14SU3",
"status": "affected"
},
{
"version": "12.5(1)SU8",
"status": "affected"
},
{
"version": "14SU3a",
"status": "affected"
},
{
"version": "12.5(1)SU8a",
"status": "affected"
},
{
"version": "15",
"status": "affected"
},
{
"version": "15SU1",
"status": "affected"
},
{
"version": "14SU4",
"status": "affected"
},
{
"version": "12.5(1)SU9",
"status": "affected"
},
{
"version": "15SU2",
"status": "affected"
},
{
"version": "15SU3",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-06T00:00:00+00:00",
"id": "CVE-2026-20034",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-35"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unity_connection:*:*:*:*:*:*:*:*",
"versionEndExcluding": "14.0",
"matchCriteriaId": "6313AB2B-8CBB-48FF-BCBF-B24DE98855EF"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unity_connection:14.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A85D56C0-D4A3-43A7-9CD1-FCEB6C8AEF66"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unity_connection:14su1:*:*:*:*:*:*:*",
"matchCriteriaId": "774C01A1-9328-45E8-9BDD-470A10BC3C2A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unity_connection:14su2:*:*:*:*:*:*:*",
"matchCriteriaId": "CD8AB4B5-12C2-4F02-A4C3-4B8C06AFFD53"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unity_connection:14su3:*:*:*:*:*:*:*",
"matchCriteriaId": "181866CE-6279-4422-8EF8-7A12DB5B21F6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unity_connection:14su4:*:*:*:*:*:*:*",
"matchCriteriaId": "D09F3655-B513-48F6-82A8-F0F946C52D25"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unity_connection:15.0:*:*:*:*:*:*:*",
"matchCriteriaId": "97CC6719-1A7F-48BA-8014-802E235ED80D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unity_connection:15su1:*:*:*:*:*:*:*",
"matchCriteriaId": "2C9412EC-282C-4926-83F8-932E24E0FC22"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unity_connection:15su2:*:*:*:*:*:*:*",
"matchCriteriaId": "37EFE547-7D3C-4D71-8D46-2C5734B9D64B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unity_connection:15su3:*:*:*:*:*:*:*",
"matchCriteriaId": "CE6AF25B-E6F9-4E15-902D-4516DFE8C8E2"
}
]
}
]
}
],
"references": [
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-unity-rce-ssrf-hENhuASy",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}