CVE-2026-20060
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The web-based management interface of Cisco Unity Connection allows an unauthenticated remote attacker to redirect a user to a malicious web page. The flaw is due to improper HTTP request parameter validation and requires the user to click a crafted link.
Risk Assessment
Potential redirection of users to phishing or malicious sites, possibly leading to credential theft. Exploitation requires user interaction.
Recommendation
Update Cisco Unity Connection to a fixed release. Additionally, deploy link filtering and user phishing awareness training.
Other vulnerabilities in Cisco Unity Connection
See all- CVE-2015-0616High
The Connection Conversation Manager (CuCsMgr) process in Cisco Unity Connection in versions 8.5 before 8.5(1)SU7, 8.6 before 8.6(2a)SU4, and 9.x before 9.1(2)SU2, when SIP trunk integration is enabled, allows remote attackers to cause a denial of service (core dump and restart) by improperly terminating SIP TCP connections.
- CVE-2015-0615High
The call-handling implementation in Cisco Unity Connection in versions before 8.5(1)SU7, 8.6 before 8.6(2a)SU4, 9.x before 9.1(2)SU2, and 10.0 before 10.0(1)SU1, when SIP trunk integration is enabled, allows remote attackers to cause a denial of service (port consumption) by improperly terminating SIP sessions.
- CVE-2015-0614High
The Connection Conversation Manager (CuCsMgr) process in Cisco Unity Connection before versions 8.5(1)SU7, 8.6(2a)SU4, 9.1(2)SU2, and 10.0(1)SU1, when SIP trunk integration is enabled, allows remote attackers to cause a denial of service via crafted SIP INVITE messages.
- CVE-2015-0613High
The Connection Conversation Manager (CuCsMgr) process in Cisco Unity Connection before version 8.5(1)SU7, 8.6 before 8.6(2a)SU4, 9.x before 9.1(2)SU2, and 10.0 before 10.0(1)SU1, when SIP trunk integration is enabled, allows remote attackers to cause a denial of service via crafted SIP INVITE messages.
- CVE-2015-0612High
The Connection Conversation Manager (CuCsMgr) process in Cisco Unity Connection versions 8.5 before 8.5(1)SU6, 8.6 before 8.6(2a)SU4, and 9.x before 9.1(2)SU2, when SIP trunk integration is enabled, allows remote attackers to cause a denial of service (SIP outage) via a crafted UDP packet.
- CVE-2014-3333High
The server in Cisco Unity Connection versions 9.1(1) and 9.1(2) allows remote authenticated users to obtain privileged access by conducting an 'HTTP Intercept' attack and leveraging the ability to read files within the context of the web-server user account.
- CVE-2026-20035High
A vulnerability in the web UI of Cisco Unity Connection Web Inbox allows an unauthenticated, remote attacker to conduct SSRF attacks. It is due to improper input validation for specific HTTP requests.
- CVE-2026-20034High
A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to execute arbitrary code on an affected device. The issue is due to insufficient validation of user-supplied input.
- CVE-2026-20081Medium
Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker to download arbitrary files from an affected system. Exploitation requires valid administrative credentials, and the vulnerabilities are due to improper sanitization of user input to the web-based management interface.
- CVE-2026-20078Medium
Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker to download arbitrary files from an affected system. Exploitation requires valid administrative credentials, and the vulnerabilities are due to improper sanitization of user input to the web-based management interface.
Original NVD description (English source)
A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of HTTP request parameters. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious web page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS