CVE-2026-20034
A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to execute arbitrary code on an affected device.
Published May 6, 2026 · updated Jul 1, 2026 · cisco unity connection
A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of a targeted device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
May 6, 2026 · NIST NVD
Detected
A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to execute arbitrary
Jul 1, 2026 · NIST NVD
Updated
A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to execute arbitrary
Affected
- cpe cisco/unity connectionversion unspecified
- cpe cisco/unity connection14.0
- cpe cisco/unity connection14su1
- cpe cisco/unity connection14su2
- cpe cisco/unity connection14su3
- cpe cisco/unity connection14su4
- cpe cisco/unity connection15.0
- cpe cisco/unity connection15su1
Sources
- CVE.orgVulnerability recordCVE-2026-20034
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-20034
A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit
nvd.nist.gov