CVE-2026-20035

HIGH

Cisco Unity Connection Server-Side Request Forgery Vulnerability

Title source: cna
STIX 2.1

Description

A vulnerability in the web UI of Cisco Unity Connection Web Inbox could allow an unauthenticated, remote attacker to conduct SSRF attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to send arbitrary network requests that are sourced from the affected device.

References (1)

Core 1

Scores

CVSS v3 7.2
EPSS 0.0002
EPSS Percentile 6.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-918
Status published
Products (21)
Cisco/Cisco Unity Connection 12.5(1)
Cisco/Cisco Unity Connection 12.5(1)SU1
Cisco/Cisco Unity Connection 12.5(1)SU2
Cisco/Cisco Unity Connection 12.5(1)SU3
Cisco/Cisco Unity Connection 12.5(1)SU4
Cisco/Cisco Unity Connection 12.5(1)SU5
Cisco/Cisco Unity Connection 12.5(1)SU6
Cisco/Cisco Unity Connection 12.5(1)SU7
Cisco/Cisco Unity Connection 12.5(1)SU8
Cisco/Cisco Unity Connection 12.5(1)SU8a
... and 11 more
Published May 06, 2026
Tracked Since May 06, 2026