Known vulnerabilities in Cisco Unity Connection

Vendor: Cisco Systems, Inc
Software: Cisco Unity Connection
Software CPE: cpe:2.3:a:cisco_systems:cisco_unity_connection:*:*:*:*:*:*:*:*
Website: https://www.cisco.com
Total vulnerabilities: 33
Public exploits: 1
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Cisco Unity Connection Cisco Unity Connection is affected by 33 known vulnerabilities: 1 critical, 4 high, 8 medium, 20 low Critical High Medium Low

Vulnerabilities (33)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU130418 - Server-Side Request Forgery (SSRF)
CVE-2026-20035		 CWE-918 Medium
No
No
 14SU5, 15SU4 07.05.2026 SB2026050724
#VU130416 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-20034		 CWE-22 Medium
No
No
 14SU5, 15SU4 07.05.2026 SB2026050724
#VU126324 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-20081		 CWE-22 Medium
No
No
 14SU6, 15SU4 16.04.2026 SB2026041638
#VU126323 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-20078		 CWE-22 Medium
No
No
 14SU6, 15SU4 16.04.2026 SB2026041638
#VU126322 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-20061		 CWE-89 Medium
No
No
 14SU6, 15SU4 16.04.2026 SB2026041638
#VU126314 - URL Redirection to Untrusted Site ('Open Redirect')
CVE-2026-20060		 CWE-601 Medium
No
No
 14SU5, 15SU4 16.04.2026 SB2026041637
#VU126311 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-20059		 CWE-79 Low
No
No
 14SU6, 15SU4 16.04.2026 SB2026041638
#VU121911 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-20045		 CWE-94 Critical
Available
Exploited
 14SU5 21.01.2026 SB2026012157
#VU110238 - Command injection
CVE-2025-20278		 CWE-77 Low
No
No
 15SU2 06.06.2025 SB2025060643
#VU109651 - Privilege Chaining
CVE-2025-20112		 CWE-268 Low
No
No
 - 22.05.2025 SB2025052222
#VU85777 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-20305		 CWE-79 Low
No
No
 15.0.0.8123, 15.0.0.9521 24.01.2024 SB2024012481
#VU85776 - Deserialization of Untrusted Data
CVE-2024-20253		 CWE-502 High
No
No
 - 24.01.2024 SB2024012480
#VU85294 - Unrestricted Upload of File with Dangerous Type
CVE-2024-20272		 CWE-434 High
No
No
 12.5.1.19017-4, 14.0.1.14006-5 11.01.2024 SB2024011114
#VU81671 - Improper input validation
CVE-2023-20259		 CWE-20 High
No
No
 CUC.014.000(001.14900.006), CUC.015.000(000.96710.005), CUC.015.000(000.97100.054) 06.10.2023 SB2023100607
#VU80178 - Permissions, Privileges, and Access Controls
CVE-2023-20266		 CWE-264 Low
No
No
 12.5.1SU8a, 14SU3a 31.08.2023 SB2023083111
#VU62476 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-20788		 CWE-79 Low
No
No
 12.5(1)SU6, 14SU1 21.04.2022 SB2022042133
#VU57948 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2021-34701		 CWE-22 Low
No
No
 - 04.11.2021 SB2021110406
#VU51972 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-1409		 CWE-79 Low
No
No
 14.0 08.04.2021 SB2021040801
#VU51969 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-1380		 CWE-79 Low
No
No
 14.0 08.04.2021 SB2021040801
#VU51966 - Improper Control of Generation of Code ('Code Injection')
CVE-2021-1362		 CWE-94 Medium
No
No
 11.5.1 SU9, 12.5.1 SU4 07.04.2021 SB2021040722


Showing elements 1 - 20 out of 33