Unified Communications Manager IM And Presence Service vulnerabilities

Product

Unified Communications Manager IM And Presence Service

by Cisco · last CVE Jan 21, 2026

On CISA KEVExploited in the wild

CVEs

On KEV

10.0

Max CVSS

New 30D

Vulnerabilities38 In the news0 Timeline

Severity mix

Critical 3High 10Medium 20Low 0

Severity

All severities38 Critical3 High10 Medium20 Low0

Exploitation

On CISA KEV1 Exploited in the wild1

Watch

Add Unified Communications Manager IM And Presence Service to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-20045 In wildKEV	9.8	5%	Jan 21	Cisco Unified Communications Products Remote Code Execution Vulnerability Affected: 12.5 before 14su5; 15.0 through 15su3a
CVE-2024-20253	10.0	2%	Jan 26	A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute arbitrary code on an… Affected: before 12.5\(1\)su8; 14.0 before 14.0su3
CVE-2017-12337	9.8	6%	Nov 16	A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Operating System software platform could allow an unauthenticated, remote… Affected: All versions, or not specified
CVE-2022-20859	8.8	1%	Jul 6	A vulnerability in the Disaster Recovery framework of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM… Affected: 14.0 before 14.0su2
CVE-2018-0363	8.8	1%	Jun 21	A vulnerability in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service (formerly CUPS) could allow an unauthenticated, remote attacker… Affected: 11.5(1)
CVE-2019-1845	8.6	5%	Jun 5	A vulnerability in the authentication service of the Cisco Unified Communications Manager IM and Presence (Unified CM IM&P) Service, Cisco TelePresence Video Communication… Affected: 11.5(1)
CVE-2022-20786	8.1	1%	Apr 21	A vulnerability in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an authenticated, remote… Affected: 11.5\(1\) before 11.5\(1\)su11; 12.5\(1\) before 12.5\(1\)su6; 14.0 before 14.0su1
CVE-2021-1365	8.1	1%	May 6	Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service could allow an authenticated, remote attacker to… Affected: 10.5 before 11.5\(1\)su9; 12.0 before 12.5\(1\)su4
CVE-2021-1363	8.1	1%	May 6	Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service could allow an authenticated, remote attacker to… Affected: 10.5 before 11.5\(1\)su9; 12.0 before 12.5\(1\)su4
CVE-2023-20108	7.5	1%	Jun 28	A vulnerability in the XCP Authentication Service of the Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an unauthenticated,… Affected: 12.5(1); 14su
CVE-2018-0409	7.5	3%	Aug 15	A vulnerability in the XCP Router service of the Cisco Unified Communications Manager IM & Presence Service (CUCM IM&P) and the Cisco TelePresence Video Communication Server (VCS)… Affected: 11.5; 11.5(1)
CVE-2016-6464	7.5	3%	Dec 14	A vulnerability in the web management interface of the Cisco Unified Communications Manager IM and Presence Service could allow an unauthenticated, remote attacker to view… Affected: 10.5(1); 10.5(2); 11.0(1); 11.5(1)
CVE-2016-1466	7.5	3%	Aug 8	Cisco Unified Communications Manager IM and Presence Service 9.1(1) SU6, 9.1(1) SU6a, 9.1(1) SU7, 10.5(2) SU2, 10.5(2) SU2a, 11.0(1) SU1, and 11.5(1) allows remote attackers to… Affected: 9.1(1); 10.5(2); 11.0(1); 11.5(1)
CVE-2025-20278	6.7	0%	Jun 4	A vulnerability in the CLI of multiple Cisco Unified Communications products could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating… Affected: 12.5(1); 12.5(1)su1; 12.5(1)su2; 12.5(1)su3; 12.5(1)su4; 12.5(1)su5; +4 more
CVE-2024-20457	6.5	0%	Nov 6	A vulnerability in the logging component of Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an authenticated, remote attacker to… Affected: 10.0(1); 10.0(1)su1; 10.0(1)su2; 10.5(1); 10.5(1)su1; 10.5(1)su2; +34 more
CVE-2022-20791	6.5	2%	Jul 6	A vulnerability in the database user privileges of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM… Affected: through 12.5\(1\); 14.0 before 14su2
CVE-2021-34773	6.5	1%	Nov 4	A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition… Affected: 10.5(2); 11.5(1); 12.5; 14.0
CVE-2021-1357	6.5	1%	Jan 20	Multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an attacker to conduct path traversal attacks and SQL… Affected: before 11.5\(1\)su9; 12.0 before 12.5\(1\)su4
CVE-2021-1355	6.5	1%	Jan 20	Multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an attacker to conduct path traversal attacks and SQL… Affected: before 11.5\(1\)su9; 12.0 before 12.5\(1\)su4
CVE-2020-27121	6.5	1%	Nov 6	A vulnerability in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) Software could allow an authenticated, remote attacker to cause the Cisco… Affected: 12.5(1)
CVE-2019-1915	6.5	1%	Oct 2	A vulnerability in the web-based interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition (SME), Cisco Unified… Affected: 12.5(1)
CVE-2025-20330	6.1	0%	Sep 3	A vulnerability in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an unauthenticated,… Affected: 15.0 before 15su3; 12.5; 14.0
CVE-2024-20310	6.1	0%	Apr 3	A vulnerability in the web-based interface of Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an unauthenticated, remote attacker to… Affected: 10.0(1); 10.0(1)su1; 10.0(1)su2; 10.5(1); 10.5(1)su1; 10.5(1)su2; +34 more
CVE-2023-20242	6.1	0%	Aug 16	A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified CM Session Management Edition (Unified CM SME), and Cisco… Affected: 11.5(1); 12.5(1); 14.0
CVE-2022-20815	6.1	1%	Jul 6	A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified CM Session Management Edition (Unified CM SME), and Cisco… Affected: 11.5\(1\) before 11.5\(1\)su11; 12.5\(1\) before 12.5\(1\)su6; 14.0 before 14.0su2
CVE-2022-20800	6.1	1%	Jul 6	A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition… Affected: 11.5\(1\) before 12.5\(1\)su5
CVE-2020-3282	6.1	1%	Jul 2	A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified… Affected: 10.5\(2\) before 10.5\(2\)su10; 11.5\(1\) before 11.5\(1\)su8; 12.0(1); 12.5(1)
CVE-2019-12707	6.1	1%	Oct 2	A vulnerability in the web-based interface of multiple Cisco Unified Communications products could allow an unauthenticated, remote attacker to conduct a cross-site scripting… Affected: 14.0(1)
CVE-2018-0396	6.1	2%	Jul 18	A vulnerability in the web framework of the Cisco Unified Communications Manager IM and Presence Service software could allow an authenticated, remote attacker to conduct a… Affected: 11.5; 12.0
CVE-2018-15403	5.4	1%	Oct 5	A vulnerability in the web interface of Cisco Emergency Responder, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, and Cisco… Affected: 10.5(1); 10.5(2); 12.0(1); 12.5(1)
CVE-2021-1364	4.9	1%	Jan 20	Multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an attacker to conduct path traversal attacks and SQL… Affected: before 11.5\(1\)su9; 12.0 before 12.5\(1\)su4
CVE-2021-1282	4.9	1%	Jan 20	Multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an attacker to conduct path traversal attacks and SQL… Affected: before 11.5\(1\)su9; 12.0 before 12.5\(1\)su4
CVE-2021-34701	4.3	2%	Nov 4	A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition… Affected: before 14su1
CVE-2015-6310	–	2%	Oct 8	The REST interface in Cisco Unified Communications Manager IM and Presence Service 11.5(1) allows remote attackers to cause a denial of service (SIP proxy service restart) via a… Affected: 11.5(1)
CVE-2015-4294	–	1%	Aug 1	Cross-site scripting (XSS) vulnerability in Cisco IM and Presence Service before 10.5 MR1 allows remote attackers to inject arbitrary web script or HTML by constructing a crafted… Affected: 9.0(1); 9.1(1); 10.5(1)
CVE-2015-4222	–	2%	Jun 26	SQL injection vulnerability in Cisco Unified Communications Manager IM and Presence Service 9.1(1) allows remote authenticated users to execute arbitrary SQL commands via… Affected: 9.1(1)
CVE-2015-4221	–	2%	Jun 26	Cisco Unified Communications Manager IM and Presence Service 9.1(1) does not properly restrict access to encrypted passwords, which allows remote attackers to determine cleartext… Affected: 9.1(1)
CVE-2014-8000	–	2%	Nov 21	Cisco Unified Communications Manager IM and Presence Service 9.1(1) produces different returned messages for URL requests depending on whether a username exists, which allows… Affected: 9.1(1)