Login Request a demo
High severity · published May 6, 2026
CVE-2026-20035
Cisco Unity Connection Server-Side Request Forgery Vulnerability
7.2
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability in the web UI of Cisco Unity Connection Web Inbox could allow an unauthenticated, remote attacker to conduct SSRF attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to send arbitrary network requests that are sourced from the affected device.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CU
Cisco Unity Connection · Cisco
12.5(1); 12.5(1)SU1; 12.5(1)SU2; 12.5(1)SU3; 12.5(1)SU4; 14; +15 more · source: vendor
UC
Unity Connection · Cisco
before 14.0; 14.0; 14su1; 14su2; 14su3; 14su4; +4 more · source: NVD
Affected product
CU
Cisco Unity Connection
Cisco
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-20035
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-20035
Vendor Advisory
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-unity-rce-ssrf-hENhuASy
More from Cisco Unity Connection
9.8
CVE-2026-20045
Cisco Unified Communications Products Remote Code Execution Vulnerability
9.8
CVE-2026-76474
Cisco Unified Communications Products Hardening Release: October 2026 - Improper Authentication Vulnerabilities
9.8
CVE-2026-76473
Cisco Unified Communications Products Hardening Release: October 2026 - Improper control of a resource through its lifetime.
9.3
CVE-2026-76475
Cisco Unified Communications Products Hardening Release: October 2026 - Cross-site Scripting Vulnerabilities
8.8
CVE-2026-76478
Cisco Unified Communications Products Hardening Release: October 2026 - Improper Access Control Vulnerabilities