VYPR
Get started
← All advisories
Medium severity4.3NVD Advisory· Published Apr 15, 2026· Updated Apr 28, 2026

CVE-2026-20061

CVE-2026-20061

Description

A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to perform an SQL injection attack against an affected device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.

This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP(S) request to the web-based management interface of an affected device. A successful exploit could allow the attacker to view data on the affected device.

Affected products

12
  • Cisco Systems, Inc./Unity Connection12 versions
    cpe:2.3:a:cisco:unity_connection:*:*:*:*:*:*:*:*+ 11 more
    • cpe:2.3:a:cisco:unity_connection:*:*:*:*:*:*:*:*range: <=12.5
    • cpe:2.3:a:cisco:unity_connection:14.0:*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:unity_connection:14su1:*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:unity_connection:14su2:*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:unity_connection:14su3:*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:unity_connection:14su3a:*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:unity_connection:14su4:*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:unity_connection:14su5:*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:unity_connection:15.0:*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:unity_connection:15su1:*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:unity_connection:15su2:*:*:*:*:*:*:*
    • cpe:2.3:a:cisco:unity_connection:15su3:*:*:*:*:*:*:*

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

1

News mentions

0

No linked articles in our index yet.