CVE-2026-20035
Full vulnerability record from the local CVENow database.
Description
A vulnerability in the web UI of Cisco Unity Connection Web Inbox could allow an unauthenticated, remote attacker to conduct SSRF attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to send arbitrary network requests that are sourced from the affected device.
Severity
HIGH
CVSS score
7.2
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-05-06 17:16:20.280000
Last modified
2026-10-26 19:10:00.163000
View original CVE JSON
{
"id": "CVE-2026-20035",
"sourceIdentifier": "[email protected]",
"published": "2026-05-06T17:16:20.280",
"lastModified": "2026-10-26T19:10:00.163",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the web UI of Cisco Unity Connection Web Inbox could allow an unauthenticated, remote attacker to conduct SSRF attacks through an affected device.\r\n\r\nThis vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to send arbitrary network requests that are sourced from the affected device."
},
{
"lang": "es",
"value": "Una vulnerabilidad en la interfaz de usuario web de Cisco Unity Connection Web Inbox podría permitir a un atacante remoto no autenticado realizar ataques SSRF a través de un dispositivo afectado.\n\nEsta vulnerabilidad se debe a una validación de entrada incorrecta para solicitudes HTTP específicas. Un atacante podría explotar esta vulnerabilidad enviando una solicitud HTTP manipulada a un dispositivo afectado. Un exploit exitoso podría permitir al atacante enviar solicitudes de red arbitrarias que se originen desde el dispositivo afectado."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Cisco",
"product": "Cisco Unity Connection",
"defaultStatus": "unknown",
"versions": [
{
"version": "12.5(1)",
"status": "affected"
},
{
"version": "12.5(1)SU1",
"status": "affected"
},
{
"version": "12.5(1)SU2",
"status": "affected"
},
{
"version": "12.5(1)SU3",
"status": "affected"
},
{
"version": "12.5(1)SU4",
"status": "affected"
},
{
"version": "14",
"status": "affected"
},
{
"version": "12.5(1)SU5",
"status": "affected"
},
{
"version": "14SU1",
"status": "affected"
},
{
"version": "12.5(1)SU6",
"status": "affected"
},
{
"version": "14SU2",
"status": "affected"
},
{
"version": "12.5(1)SU7",
"status": "affected"
},
{
"version": "14SU3",
"status": "affected"
},
{
"version": "12.5(1)SU8",
"status": "affected"
},
{
"version": "14SU3a",
"status": "affected"
},
{
"version": "12.5(1)SU8a",
"status": "affected"
},
{
"version": "15",
"status": "affected"
},
{
"version": "15SU1",
"status": "affected"
},
{
"version": "14SU4",
"status": "affected"
},
{
"version": "12.5(1)SU9",
"status": "affected"
},
{
"version": "15SU2",
"status": "affected"
},
{
"version": "15SU3",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 2.7
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-06T17:27:15.669186Z",
"id": "CVE-2026-20035",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-918"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unity_connection:*:*:*:*:*:*:*:*",
"versionEndExcluding": "14.0",
"matchCriteriaId": "6313AB2B-8CBB-48FF-BCBF-B24DE98855EF"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unity_connection:14.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A85D56C0-D4A3-43A7-9CD1-FCEB6C8AEF66"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unity_connection:14su1:*:*:*:*:*:*:*",
"matchCriteriaId": "774C01A1-9328-45E8-9BDD-470A10BC3C2A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unity_connection:14su2:*:*:*:*:*:*:*",
"matchCriteriaId": "CD8AB4B5-12C2-4F02-A4C3-4B8C06AFFD53"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unity_connection:14su3:*:*:*:*:*:*:*",
"matchCriteriaId": "181866CE-6279-4422-8EF8-7A12DB5B21F6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unity_connection:14su4:*:*:*:*:*:*:*",
"matchCriteriaId": "D09F3655-B513-48F6-82A8-F0F946C52D25"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unity_connection:15.0:*:*:*:*:*:*:*",
"matchCriteriaId": "97CC6719-1A7F-48BA-8014-802E235ED80D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unity_connection:15su1:*:*:*:*:*:*:*",
"matchCriteriaId": "2C9412EC-282C-4926-83F8-932E24E0FC22"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unity_connection:15su2:*:*:*:*:*:*:*",
"matchCriteriaId": "37EFE547-7D3C-4D71-8D46-2C5734B9D64B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unity_connection:15su3:*:*:*:*:*:*:*",
"matchCriteriaId": "CE6AF25B-E6F9-4E15-902D-4516DFE8C8E2"
}
]
}
]
}
],
"references": [
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-unity-rce-ssrf-hENhuASy",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}