UC
Product
Unified Communications Manager
On CISA KEVExploited in the wild
238
CVEs
2
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 4High 24Medium 75Low 0
Watch
Add Unified Communications Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-20045 In wildKEV | 9.8 | Jan 21 | Cisco Unified Communications Products Remote Code Execution Vulnerability Affected: 12.5 before 14su5; 12.5 before 14su5; 15.0 through 15su3a; 15.0 through 15su3a |
| CVE-2026-20230 In wildKEV | 8.6 | Jun 3 | Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability Affected: 14.0 before 14su6; 14.0 before 14su6; 15.0 through 15su4a; 15.0 through 15su4a |
| CVE-2025-20309 | 10.0 | Jul 2 | A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an… Affected: 15.0.1.13010-1; 15.0.1.13010-1; 15.0.1.13011-1; 15.0.1.13011-1; 15.0.1.13012-1; 15.0.1.13012-1; +10 more |
| CVE-2024-20253 | 10.0 | Jan 26 | A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute arbitrary code on an… Affected: before 12.5\(1\)su8; 14.0 before 14su3; before 12.5\(1\)su8; 14.0 before 14su3 |
| CVE-2017-12337 | 9.8 | Nov 16 | A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Operating System software platform could allow an unauthenticated, remote… Affected: All versions, or not specified |
| CVE-2025-20326 | 8.8 | Sep 3 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) Software and Cisco Unified CM Session Management Edition (SME) Software… Affected: 15.0 before 15su3; 12.5; 14.0 |
| CVE-2023-20211 | 8.8 | Aug 16 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition… Affected: 12.5\(1\) before 12.5\(1\)sub; 12.5\(1\) before 12.5\(1\)sub; 14.0; 14.0 |
| CVE-2023-20010 | 8.8 | Jan 20 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition… Affected: before 12.5\(1\)su7; 11.5\(1\) before 12.5\(1\)su7; 14.0 before 14su2; 14.0 before 14su2 |
| CVE-2022-20859 | 8.8 | Jul 6 | A vulnerability in the Disaster Recovery framework of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM… Affected: 14.0 before 14su2 |
| CVE-2021-1362 | 8.8 | Apr 8 | A vulnerability in the SOAP API endpoint of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications… Affected: 10.5\(2\) before 11.5\(1\)su9; 10.5\(2\) before 11.5\(1\)su9; 12.0\(1\) before 12.5\(1\)su4; 12.0\(1\) before 12.5\(1\)su4 |
| CVE-2020-3135 | 8.8 | Sep 23 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (UCM) could allow an unauthenticated, remote attacker to conduct a cross-site request… Affected: before 11.5\(1\) |
| CVE-2019-15972 | 8.8 | Nov 26 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct SQL injection attacks on an… Affected: 10.5(2.10000.5); 11.5(1.10000.6); 12.0(1.10000.10); 12.5(1.10000.22) |
| CVE-2018-0474 | 8.8 | Jan 10 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view digest credentials in clear… Affected: 10.5(2.14076.1) |
| CVE-2017-6757 | 8.8 | Aug 7 | A vulnerability in Cisco Unified Communications Manager 10.5(2.10000.5), 11.0(1.10000.10), and 11.5(1.10000.6) could allow an authenticated, remote attacker to conduct a blind SQL… Affected: 10.5(2.10000.5); 11.0(1.10000.10); 11.5(1.10000.6) |
| CVE-2022-20816 | 8.1 | Aug 10 | Cisco Unified Communications Manager Arbitrary File Deletion Vulnerability Affected: 11.5\(1\) before 14su2; 11.5\(1\) before 14su2 |
| CVE-2024-20375 | 7.5 | Aug 21 | A vulnerability in the SIP call processing function of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition… Affected: 12.0(1)su1; 12.0(1)su2; 12.0(1)su3; 12.0(1)su4; 12.0(1)su5; 12.5(1); +10 more |
| CVE-2023-20259 | 7.5 | Oct 4 | A vulnerability in an API endpoint of multiple Cisco Unified Communications Products could allow an unauthenticated, remote attacker to cause high CPU utilization, which could… Affected: 12.5(1)su7; 12.5(1)su7; 14su3; 14su3 |
| CVE-2020-3177 | 7.5 | Apr 15 | A vulnerability in the Tool for Auto-Registered Phones Support (TAPS) of Cisco Unified Communications Manager (UCM) and Cisco Unified Communications Manager Session Management… Affected: 10.5(2.10000.5); 11.5(1.10000.6); 12.0(1.10000.10); 12.5(1.10000.22) |
| CVE-2019-1887 | 7.5 | Jul 6 | A vulnerability in the Session Initiation Protocol (SIP) protocol implementation of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to cause a… Affected: 10.5(2.10000.5); 11.5(1.10000.6); 12.0(1.10000.10); 12.5(1.10000.22) |
| CVE-2019-1837 | 7.5 | Apr 18 | A vulnerability in the User Data Services (UDS) API of Cisco Unified Communications Manager (Unified CM) could allow an unauthenticated, remote attacker to cause a denial of… Affected: 10.5(2.10000.5); 11.5(1.10000.6); 12.0(1.10000.10); 12.5(1.10000.22) |
| CVE-2017-6779 | 7.5 | Jun 7 | Multiple Cisco products are affected by a vulnerability in local file management for certain system log files of Cisco collaboration products that could allow an unauthenticated,… Affected: 10.0 before 10.5\(2\)su5; 11.0 before 11.0\(1a\)su4; 11.5 before 11.5\(1\)su3; 10.5(2.10000.5); 11.0(1.10000.10); 11.5(1.10000.6); +1 more |
| CVE-2017-6791 | 7.5 | Sep 7 | A vulnerability in the Trust Verification Service (TVS) of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to cause a denial of service (DoS)… Affected: 9.1(2.10000.28); 10.0(1.10000.24); 10.5(2.10000.5); 11.0(1.10000.10) |
| CVE-2017-3808 | 7.5 | Apr 20 | A vulnerability in the Session Initiation Protocol (SIP) UDP throttling process of Cisco Unified Communications Manager (Cisco Unified CM) could allow an unauthenticated, remote… Affected: 10.0(1.10000.12); 10.0_base; 10.5(0.98000.88); 10.5(1.98991.13); 10.5(1.99995.9); 10.5(2.10000.5); +14 more |
| CVE-2016-9210 | 7.5 | Dec 14 | A vulnerability in the Cisco Unified Reporting upload tool accessed via the Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to modify… Affected: 11.5(1.11007.2) |
| CVE-2016-6364 | 7.5 | Aug 23 | The User Data Services (UDS) API implementation in Cisco Unified Communications Manager 11.5 allows remote attackers to bypass intended access restrictions and obtain sensitive… Affected: 11.5.0 |
| CVE-2015-6360 | 7.5 | Apr 21 | The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial of service via crafted fields in SRTP packets, aka Bug ID CSCux00686 Affected: 9.9(9)st1.9 |
| CVE-2013-7030 | 7.3 | Dec 12 | The TFTP service in Cisco Unified Communications Manager (aka CUCM or Unified CM) allows remote attackers to obtain sensitive information from a phone via an RRQ operation, as… Affected: All versions, or not specified |
| CVE-2023-20266 | 7.2 | Aug 30 | A vulnerability in Cisco Emergency Responder, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME),… Affected: 12.5.1su8; 12.5.1su8 |
| CVE-2022-20787 | 6.8 | Apr 21 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) Software and Cisco Unified CM Session Management Edition (SME) Software… Affected: 12.5\(1\) before 12.5\(1\)su6; 12.5\(1\) before 12.5\(1\)su6; 14.0 before 14su1; 14.0 before 14su1 |
| CVE-2025-20278 | 6.7 | Jun 4 | A vulnerability in the CLI of multiple Cisco Unified Communications products could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating… Affected: 12.5(1); 12.5(1)su1; 12.5(1)su2; 12.5(1)su3; 12.5(1)su4; 12.5(1)su5; +6 more |
| CVE-2022-20791 | 6.5 | Jul 6 | A vulnerability in the database user privileges of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM… Affected: through 11.5\(1.10000.6\); through 11.5\(1.10000.6\); 12.5 through 12.5\(1.10000.22\); 12.5 through 12.5\(1.10000.22\); 14.0 through 14.0\(1.10000.20\); 14.0 through 14.0\(1.10000.20\) |
| CVE-2022-20804 | 6.5 | Apr 21 | A vulnerability in the Cisco Discovery Protocol of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified… Affected: through 14.0; through 14.0 |
| CVE-2022-20790 | 6.5 | Apr 21 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition… Affected: through 14.0; through 14.0 |
| CVE-2022-20789 | 6.5 | Apr 21 | A vulnerability in the software upgrade process of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified… Affected: 12.5(1); 12.5(1); 14.0; 14.0 |
| CVE-2021-34773 | 6.5 | Nov 4 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition… Affected: 14.0(1.10000.20) |
| CVE-2021-1478 | 6.5 | May 6 | A vulnerability in the Java Management Extensions (JMX) component of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management… Affected: before 12.6; before 12.6 |
| CVE-2021-1357 | 6.5 | Jan 20 | Multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an attacker to conduct path traversal attacks and SQL… Affected: before 11.5\(1\)su9; before 11.5\(1\)su9; 12.0 before 12.0\(1\)su4; 12.0 before 12.0\(1\)su4; 12.5 before 12.5\(1\)su4; 12.5 before 12.5\(1\)su4 |
| CVE-2021-1355 | 6.5 | Jan 20 | Multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an attacker to conduct path traversal attacks and SQL… Affected: before 11.5\(1\)su9; before 11.5\(1\)su9; 12.0 before 12.0\(1\)su4; 12.0 before 12.0\(1\)su4; 12.5 before 12.5\(1\)su4; 12.5 before 12.5\(1\)su4 |
| CVE-2021-1226 | 6.5 | Jan 13 | A vulnerability in the audit logging component of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified… Affected: 11.5\(1\) before 11.5\(1\)su9; 11.5\(1\) before 11.5\(1\)su9; 10.5(2); 10.5(2) |
| CVE-2019-15963 | 6.5 | Sep 23 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view sensitive information in the… Affected: 10.5 through 10.5\(2.10000.5\); 11.5 through 11.5\(1.10000.6\); 12.0 through 12.0\(1.10000.10\); 12.5 through 12.5\(1.10000.22\) |
| CVE-2019-1915 | 6.5 | Oct 2 | A vulnerability in the web-based interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition (SME), Cisco Unified… Affected: 10.5(2.10000.5); 11.5(1.10000.6); 12.0(1.10000.10); 12.5(1.10000.22) |
| CVE-2019-15272 | 6.5 | Oct 2 | A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an… Affected: 10.5(2.10000.5); 11.5(1.10000.6); 12.0(1.10000.10); 12.5(1.10000.22) |
| CVE-2019-12711 | 6.5 | Oct 2 | A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an… Affected: 10.5(2.10000.5); 11.5(1.10000.6); 12.0(1.10000.10); 12.5(1.10000.22) |
| CVE-2018-0267 | 6.5 | Apr 19 | A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, local attacker to view sensitive data that should be restricted Affected: 10.5(2.10000.5); 11.0(1.10000.10); 11.5(1.10000.6); 12.0(1.10000.10) |
| CVE-2017-6758 | 6.5 | Aug 7 | A vulnerability in the web framework of Cisco Unified Communications Manager 11.5(1.10000.6) could allow an authenticated, remote attacker to access arbitrary files in the context… Affected: 11.5(1.10000.6) |
| CVE-2017-3877 | 6.5 | Mar 17 | A vulnerability in the web framework of Cisco Unified Communications Manager (CallManager) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery… Affected: 11.5(1.11.007.2) |
| CVE-2016-6440 | 6.5 | Oct 27 | The Cisco Unified Communications Manager (CUCM) may be vulnerable to data that can be displayed inside an iframe within a web page, which in turn could lead to a clickjacking… Affected: 11.5(0.99838.4) |
| CVE-2015-6433 | 6.5 | Jan 8 | SQL injection vulnerability in Cisco Unified Communications Manager 11.0(0.98000.225) allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka… Affected: 11.0(0.98000.225) |
| CVE-2024-20511 | 6.1 | Nov 6 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition… Affected: 12.0(1)su1; 12.0(1)su2; 12.0(1)su3; 12.0(1)su4; 12.0(1)su5; 12.5(1); +11 more |
| CVE-2024-20488 | 6.1 | Aug 21 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition… Affected: 12.5(1); 12.5(1)su1; 12.5(1)su2; 12.5(1)su3; 12.5(1)su4; 12.5(1)su5; +15 more |