VYPR
← All advisories
High severity8.8NVD Advisory· Published May 6, 2026· Updated Jul 1, 2026

CVE-2026-20034

CVE-2026-20034

Description

A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to execute arbitrary code on an affected device.

This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of a targeted device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

11
  • Cisco Systems, Inc./Unity Connection11 versions
    cpe:2.3:a:cisco:unity_connection:*:*:*:*:*:*:*:*+ 10 more
    • cpe:2.3:a:cisco:unity_connection:*:*:*:*:*:*:*:*range: <14.0
    • cpe:2.3:a:cisco:unity_connection:14.0:*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:unity_connection:14su1:*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:unity_connection:14su2:*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:unity_connection:14su3:*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:unity_connection:14su4:*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:unity_connection:15.0:*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:unity_connection:15su1:*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:unity_connection:15su2:*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:unity_connection:15su3:*:*:*:*:*:*:*
    • (no CPE)

Patches

Vulnerability mechanics

References

1

News mentions

1