UC
Product
Unity Connection
On CISA KEVExploited in the wild
64
CVEs
1
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 4High 8Medium 30Low 0
Watch
Add Unity Connection to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-20045 In wildKEV | 9.8 | Jan 21 | Cisco Unified Communications Products Remote Code Execution Vulnerability Affected: 12.5 before 14su5; 15.0 through 15su3 |
| CVE-2024-20253 | 10.0 | Jan 26 | A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute arbitrary code on an… Affected: before 12.5\(1\)su8; 14.0 before 14su3 |
| CVE-2024-20272 | 9.8 | Jan 17 | A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system and… Affected: before 12.5.1.19017-4; 14.0 before 14.0.1.14006-5 |
| CVE-2017-12337 | 9.8 | Nov 16 | A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Operating System software platform could allow an unauthenticated, remote… Affected: All versions, or not specified |
| CVE-2026-20034 | 8.8 | May 6 | Cisco Unity Connection Remote Code Execution Vulnerability Affected: before 14.0; 14.0; 14su1; 14su2; 14su3; 14su4; +4 more |
| CVE-2022-20859 | 8.8 | Jul 6 | A vulnerability in the Disaster Recovery framework of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM… Affected: 14.0 before 14su2 |
| CVE-2021-1362 | 8.8 | Apr 8 | A vulnerability in the SOAP API endpoint of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications… Affected: 10.5\(2\) before 11.5\(1\)su9; 12.0\(1\) before 12.5\(1\)su4 |
| CVE-2023-20259 | 7.5 | Oct 4 | A vulnerability in an API endpoint of multiple Cisco Unified Communications Products could allow an unauthenticated, remote attacker to cause high CPU utilization, which could… Affected: 14su3 |
| CVE-2017-6779 | 7.5 | Jun 7 | Multiple Cisco products are affected by a vulnerability in local file management for certain system log files of Cisco collaboration products that could allow an unauthenticated,… Affected: 10.5 before 10.5su5; 11.0 before 11.5.1su3; 9.5(0.9)tt0; 12.0 |
| CVE-2015-6360 | 7.5 | Apr 21 | The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial of service via crafted fields in SRTP packets, aka Bug ID CSCux00686 Affected: 1.1(1); 1.2_base; 2.0(1); 2.0_base; 2.1_base; 7.0_base; +34 more |
| CVE-2026-20035 | 7.2 | May 6 | Cisco Unity Connection Server-Side Request Forgery Vulnerability Affected: before 14.0; 14.0; 14su1; 14su2; 14su3; 14su4; +4 more |
| CVE-2023-20266 | 7.2 | Aug 30 | A vulnerability in Cisco Emergency Responder, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME),… Affected: 12.5(1)su6; 12.5(1)su7; 12.5(1)su8; 14su2; 14su3 |
| CVE-2018-15396 | 6.8 | Oct 5 | A vulnerability in the Bulk Administration Tool (BAT) for Cisco Unity Connection could allow an authenticated, remote attacker to cause high disk utilization, resulting in a… Affected: 12.5 |
| CVE-2025-20278 | 6.7 | Jun 4 | A vulnerability in the CLI of multiple Cisco Unified Communications products could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating… Affected: 12.5(1); 12.5(1)su1; 12.5(1)su2; 12.5(1)su3; 12.5(1)su4; 12.5(1)su5; +5 more |
| CVE-2026-20061 | 6.5 | Apr 15 | Cisco Unity Connection SQL Injection Vulnerability Affected: through 12.5; 14.0; 14su1; 14su2; 14su3; 14su3a; +6 more |
| CVE-2026-20081 | 6.5 | Apr 15 | Cisco Unity Connection Arbitrary File Download Vulnerability Affected: through 12.5; 14.0; 14su1; 14su2; 14su3; 14su3a; +6 more |
| CVE-2026-20078 | 6.5 | Apr 15 | Cisco Unity Connection Arbitrary File Download Vulnerability Affected: through 12.5; 14.0; 14su1; 14su2; 14su3; 14su3a; +6 more |
| CVE-2021-1226 | 6.5 | Jan 13 | A vulnerability in the audit logging component of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified… Affected: 11.5\(1\) before 11.5\(1\)su9; 12.0\(1\) before 12.0\(1\)su4; 12.5\(1\) before 12.5\(1\)su3; 10.5(2) |
| CVE-2020-3130 | 6.5 | Sep 23 | A vulnerability in the web management interface of Cisco Unity Connection could allow an authenticated remote attacker to overwrite files on the underlying filesystem Affected: 11.0 before 11.5su7; 12.0 before 12.5su2 |
| CVE-2019-1915 | 6.5 | Oct 2 | A vulnerability in the web-based interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition (SME), Cisco Unified… Affected: 11.5; 12.0; 12.5; 14.0 |
| CVE-2026-20059 | 6.1 | Apr 15 | Cisco Unity Connection Reflected Cross-Site Scripting Vulnerability Affected: through 12.5; 14.0; 14su1; 14su2; 14su3; 14su3a; +6 more |
| CVE-2022-20800 | 6.1 | Jul 6 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition… Affected: 11.5\(1\) before 14su2 |
| CVE-2022-20788 | 6.1 | Apr 21 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified CM Session Management Edition (Unified CM SME), and Cisco… Affected: 12.5\(1\) before 12.5\(1\)su6; 14.0 before 14su1 |
| CVE-2021-1409 | 6.1 | Apr 8 | Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service… Affected: before 14.0 |
| CVE-2021-1380 | 6.1 | Apr 8 | Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service… Affected: before 14.0 |
| CVE-2020-3282 | 6.1 | Jul 2 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified… Affected: 10.5\(2\) before 10.5\(2\)su10; 11.5\(1\) before 11.5\(1\)su8; 12.0(1); 12.5(1) |
| CVE-2019-12707 | 6.1 | Oct 2 | A vulnerability in the web-based interface of multiple Cisco Unified Communications products could allow an unauthenticated, remote attacker to conduct a cross-site scripting… Affected: 11.5; 12.0; 12.5 |
| CVE-2019-1685 | 6.1 | Feb 21 | Cisco Unity Connection Reflected Cross-Site Scripting Vulnerability Affected: 12.5 |
| CVE-2018-0354 | 6.1 | Jun 7 | A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of… Affected: 12.5 |
| CVE-2017-12212 | 6.1 | Sep 7 | A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a… Affected: 10.5(2) |
| CVE-2016-1377 | 6.1 | Apr 12 | Cross-site scripting (XSS) vulnerability in Cisco Unity Connection through 11.0 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug… Affected: 10.0.0; 10.0.5; 10.5(2); 10.5(2.3009); 11.0(0.98000.225); 11.0.0 |
| CVE-2016-1304 | 6.1 | Jan 30 | Cross-site scripting (XSS) vulnerability in Cisco Unity Connection 10.5(2.3009) allows remote attackers to inject arbitrary web script or HTML via a crafted value, aka Bug ID… Affected: 10.5(2.3009) |
| CVE-2016-1300 | 6.1 | Jan 27 | Cross-site scripting (XSS) vulnerability in Cisco Unity Connection (UC) 10.5(2.3009) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID… Affected: 10.5(2.3009) |
| CVE-2018-15403 | 5.4 | Oct 5 | A vulnerability in the web interface of Cisco Emergency Responder, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, and Cisco… Affected: 9.1(1)es23 |
| CVE-2022-20752 | 5.3 | Jul 6 | A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection… Affected: 12.5\(1\) before 12.5\(1\)su6; 14.0 before 14su1 |
| CVE-2018-0203 | 5.3 | Feb 22 | A vulnerability in the SMTP relay of Cisco Unity Connection could allow an unauthenticated, remote attacker to send unsolicited email messages, aka a Mail Relay Vulnerability Affected: All versions, or not specified |
| CVE-2017-6629 | 5.3 | May 3 | A vulnerability in the ImageID parameter of Cisco Unity Connection 10.5(2) could allow an unauthenticated, remote attacker to access files in arbitrary locations on the filesystem… Affected: 10.5(2) |
| CVE-2024-20305 | 4.8 | Jan 26 | A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack… Affected: before 15.0 |
| CVE-2020-3129 | 4.8 | Jan 26 | A vulnerability in the web-based management interface of Cisco Unity Connection Software could allow an authenticated, remote attacker to perform a stored cross-site scripting… Affected: before 12.5su2 |
| CVE-2018-15426 | 4.8 | Oct 5 | A vulnerability in the web-based interface of Cisco Unity Connection could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a… Affected: vmo-11.5(1) |
| CVE-2026-20060 | 4.7 | Apr 15 | Cisco Unity Connection Open Redirect Vulnerability Affected: through 12.5; 14.0; 14su1; 14su2; 14su3; 14su3a; +5 more |
| CVE-2021-34701 | 4.3 | Nov 4 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition… Affected: before 14su1 |
| CVE-2015-6408 | – | Dec 12 | Cross-site request forgery (CSRF) vulnerability in Cisco Unity Connection 11.5(0.98) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCux24578 Affected: 11.5(0.98) |
| CVE-2015-6390 | – | Dec 3 | Cross-site scripting (XSS) vulnerability in the management interface in Cisco Unity Connection 9.1(1.10) allows remote attackers to inject arbitrary web script or HTML via a… Affected: 9.1(1.10) |
| CVE-2015-6299 | – | Sep 20 | SQL injection vulnerability in the web interface in Cisco Unity Connection 9.1(1.2) and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted… Affected: 9.1(1); 9.1(2) |
| CVE-2015-0716 | – | May 7 | Cross-site request forgery (CSRF) vulnerability in the CUCReports page in Cisco Unity Connection 11.0(0.98000.225) and 11.0(0.98000.332) allows remote attackers to hijack the… Affected: 11.0(0.98000.225); 11.0(0.98000.332) |
| CVE-2015-0715 | – | May 7 | SQL injection vulnerability in the administrative web interface in Cisco Unified Communications Manager 11.0(0.98000.225) allows remote authenticated users to execute arbitrary… Affected: 11.0(0.98000.225) |
| CVE-2015-0616 | – | Apr 3 | The Connection Conversation Manager (aka CuCsMgr) process in Cisco Unity Connection 8.5 before 8.5(1)SU7, 8.6 before 8.6(2a)SU4, and 9.x before 9.1(2)SU2, when SIP trunk… Affected: 8.5(1); 8.5(1)su1; 8.5(1)su2; 8.5(1)su3; 8.5(1)su4; 8.5(1)su5; +13 more |
| CVE-2015-0615 | – | Apr 3 | The call-handling implementation in Cisco Unity Connection 8.5 before 8.5(1)SU7, 8.6 before 8.6(2a)SU4, 9.x before 9.1(2)SU2, and 10.0 before 10.0(1)SU1, when SIP trunk… Affected: 8.5(1); 8.5(1)su1; 8.5(1)su2; 8.5(1)su3; 8.5(1)su4; 8.5(1)su5; +15 more |
| CVE-2015-0614 | – | Apr 3 | The Connection Conversation Manager (aka CuCsMgr) process in Cisco Unity Connection 8.5 before 8.5(1)SU7, 8.6 before 8.6(2a)SU4, 9.x before 9.1(2)SU2, and 10.0 before 10.0(1)SU1,… Affected: 8.5(1); 8.5(1)su1; 8.5(1)su2; 8.5(1)su3; 8.5(1)su4; 8.5(1)su5; +15 more |