CVE-2026-20061
Full vulnerability record from the local CVENow database.
Description
A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to perform an SQL injection attack against an affected device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP(S) request to the web-based management interface of an affected device. A successful exploit could allow the attacker to view data on the affected device.
Severity
MEDIUM
CVSS score
6.5
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-04-15 17:17:01.433000
Last modified
2026-10-26 21:10:00.170000
View original CVE JSON
{
"id": "CVE-2026-20061",
"sourceIdentifier": "[email protected]",
"published": "2026-04-15T17:17:01.433",
"lastModified": "2026-10-26T21:10:00.170",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to perform an SQL injection attack against an affected device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.\r\n\r\nThis vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP(S) request to the web-based management interface of an affected device. A successful exploit could allow the attacker to view data on the affected device."
},
{
"lang": "es",
"value": "Una vulnerabilidad en la interfaz de gestión basada en web de Cisco Unity Connection podría permitir a un atacante remoto autenticado realizar un ataque de inyección SQL contra un dispositivo afectado. Para explotar esta vulnerabilidad, el atacante debe tener credenciales de usuario válidas en el dispositivo afectado.\n\nEsta vulnerabilidad se debe a una validación insuficiente de la entrada proporcionada por el usuario. Un atacante podría explotar esta vulnerabilidad enviando una solicitud HTTP(S) manipulada a la interfaz de gestión basada en web de un dispositivo afectado. Un exploit exitoso podría permitir al atacante ver datos en el dispositivo afectado."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Cisco",
"product": "Cisco Unity Connection",
"defaultStatus": "unknown",
"versions": [
{
"version": "14",
"status": "affected"
},
{
"version": "14SU1",
"status": "affected"
},
{
"version": "14SU2",
"status": "affected"
},
{
"version": "14SU3",
"status": "affected"
},
{
"version": "14SU3a",
"status": "affected"
},
{
"version": "15",
"status": "affected"
},
{
"version": "15SU1",
"status": "affected"
},
{
"version": "14SU4",
"status": "affected"
},
{
"version": "15SU2",
"status": "affected"
},
{
"version": "15SU3",
"status": "affected"
},
{
"version": "14SU5",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-15T16:42:14.106646Z",
"id": "CVE-2026-20061",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-89"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unity_connection:*:*:*:*:*:*:*:*",
"versionEndIncluding": "12.5",
"matchCriteriaId": "6DAF417F-F480-4A4D-845B-8338776FF253"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unity_connection:14.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A85D56C0-D4A3-43A7-9CD1-FCEB6C8AEF66"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unity_connection:14su1:*:*:*:*:*:*:*",
"matchCriteriaId": "774C01A1-9328-45E8-9BDD-470A10BC3C2A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unity_connection:14su2:*:*:*:*:*:*:*",
"matchCriteriaId": "CD8AB4B5-12C2-4F02-A4C3-4B8C06AFFD53"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unity_connection:14su3:*:*:*:*:*:*:*",
"matchCriteriaId": "181866CE-6279-4422-8EF8-7A12DB5B21F6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unity_connection:14su3a:*:*:*:*:*:*:*",
"matchCriteriaId": "7B70BACC-B771-4049-8A55-3B277913DEEF"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unity_connection:14su4:*:*:*:*:*:*:*",
"matchCriteriaId": "D09F3655-B513-48F6-82A8-F0F946C52D25"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unity_connection:14su5:*:*:*:*:*:*:*",
"matchCriteriaId": "E51AF0FF-016D-4F20-8F88-0E70D18C375C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unity_connection:15.0:*:*:*:*:*:*:*",
"matchCriteriaId": "97CC6719-1A7F-48BA-8014-802E235ED80D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unity_connection:15su1:*:*:*:*:*:*:*",
"matchCriteriaId": "2C9412EC-282C-4926-83F8-932E24E0FC22"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unity_connection:15su2:*:*:*:*:*:*:*",
"matchCriteriaId": "37EFE547-7D3C-4D71-8D46-2C5734B9D64B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cisco:unity_connection:15su3:*:*:*:*:*:*:*",
"matchCriteriaId": "CE6AF25B-E6F9-4E15-902D-4516DFE8C8E2"
}
]
}
]
}
],
"references": [
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-unity-vulns-n2EJSbbw",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}