Known vulnerabilities in Cisco Unified Communications Manager Session Management Edition

Vendor: Cisco Systems, Inc
Software: Cisco Unified Communications Manager Session Management Edition
Software CPE: cpe:2.3:a:cisco_systems:cisco_unified_communications_manager_session_management_edition:*:*:*:*:*:*:*:*
Website: https://www.cisco.com
Total vulnerabilities: 32
Public exploits: 1
Known exploited (KEV): 2
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Cisco Unified Communications Manager Session Management Edition Cisco Unified Communications Manager Session Management Edition is affected by 32 known vulnerabilities: 2 critical, 2 high, 8 medium, 20 low Critical High Medium Low

Vulnerabilities (32)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU133306 - Server-Side Request Forgery (SSRF)
CVE-2026-20230		 CWE-918 Critical
No
Exploited
 14SU6 04.06.2026 SB2026060401
#VU121911 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-20045		 CWE-94 Critical
Available
Exploited
 14SU5 21.01.2026 SB2026012157
#VU116387 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-20361		 CWE-79 Low
No
No
 15SU3 02.10.2025 SB2025100209
#VU110238 - Command injection
CVE-2025-20278		 CWE-77 Low
No
No
 15SU2 06.06.2025 SB2025060643
#VU100050 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-20511		 CWE-79 Low
No
No
 15SU2 07.11.2024 SB2024110737
#VU85776 - Deserialization of Untrusted Data
CVE-2024-20253		 CWE-502 High
No
No
 - 24.01.2024 SB2024012480
#VU81671 - Improper input validation
CVE-2023-20259		 CWE-20 High
No
No
 12.5(1)SU8 06.10.2023 SB2023100607
#VU80178 - Permissions, Privileges, and Access Controls
CVE-2023-20266		 CWE-264 Low
No
No
 12.5.1SU8a 31.08.2023 SB2023083111
#VU79948 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2023-20211		 CWE-89 Medium
No
No
 - 24.08.2023 SB2023082428
#VU77086 - Improper input validation
CVE-2023-20116		 CWE-20 Medium
No
No
 12.5(1)SU8, 14SU3 08.06.2023 SB2023060811
#VU71331 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2023-20010		 CWE-89 Medium
No
No
 12.5(1)SU7 18.01.2023 SB2023011899
#VU66111 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2022-20816		 CWE-22 Medium
No
No
 14SU2 04.08.2022 SB2022080429
#VU62477 - External Control of File Name or Path
CVE-2022-20789		 CWE-73 Low
No
No
 12.5(1)SU5, 14SU1 21.04.2022 SB2022042130
#VU62473 - Improper Check for Unusual or Exceptional Conditions
CVE-2022-20804		 CWE-754 Low
No
No
 14SU1 21.04.2022 SB2022042132
#VU62465 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2022-20790		 CWE-22 Medium
No
No
 14SU1 21.04.2022 SB2022042111
#VU57948 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2021-34701		 CWE-22 Low
No
No
 - 04.11.2021 SB2021110406
#VU57947 - Cross-Site Request Forgery (CSRF)
CVE-2021-34773		 CWE-352 Low
No
No
 - 04.11.2021 SB2021110405
#VU52933 - Improper Access Control
CVE-2021-1478		 CWE-284 Medium
No
No
 12.6 06.05.2021 SB2021050624
#VU51972 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-1409		 CWE-79 Low
No
No
 14.0.1.11900.3 08.04.2021 SB2021040801
#VU51971 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-1408		 CWE-79 Low
No
No
 14.0.1.11900.3 08.04.2021 SB2021040801


Showing elements 1 - 20 out of 32