CVE-2026-20034High· 8.8▾ TwilightA vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to insufficient validation of use…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.7%
A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to execute arbitrary code on an affected device.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of a targeted device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.
unity_connection < 14.0unity_connection = 14.0unity_connection = 14su1unity_connection = 14su2unity_connection = 14su3unity_connection = 14su4unity_connection = 15.0unity_connection = 15su1unity_connection = 15su2unity_connection = 15su3Upgrade past the affected range:
unity_connection 14.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-20035High· 7.2A vulnerability in the web UI of Cisco Unity Connection Web Inbox could allow an unauthenticated, remote attacker to conduct SSRF attacks through an affected device. This vulnerability is due to improper input validation for specific …
CVE-2025-20313Medium· 6.7Multiple vulnerabilities in Cisco IOS XE Software of could allow an authenticated, local attacker with level-15 privileges or an unauthenticated attacker with physical access to the device to execute persistent code at boot time and brea…
CVE-2026-20179Medium· 5.8Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerabilities
CVE-2026-20011Medium· 5.8Multiple Cisco Products Snort 3 SMTP MIME Denial of Service Vulnerability
CVE-2026-20291High· 7.8Multiple Cisco Products Snort 3 Software Hardening Release: October 2026
CVE-2026-20043Critical· 9.0Multiple Cisco Products Snort 3 Software Hardening Release: October 2026