Skip to content
OpenAdvisories
Medium WID-SEC-2026-1149 5 CVEs

Cisco Unity Connection: Mehrere Schwachstellen

Published Apr 15, 2026 · Updated Apr 15, 2026 · de-DE

Vendor: Cisco Product: Unity Connection

Summary

Ein Angreifer kann mehrere Schwachstellen in Cisco Unity Connection ausnutzen, um Cross-Site-Scripting-Angriffe durchzuführen, Benutzer auf bösartige Websites umzuleiten, Daten zu manipulieren und vertrauliche Informationen offenzulegen.

Product

Cisco Unity Connection ist ein umfangreiches Voicemail und Integrated-Messaging- Produkt. Mit Cisco Unity Connection können Benutzer mit dem Cisco Unified Personal Communicator auf ihre Sprachnachrichten zugreifen, das Display ihres Cisco Unified IP-Telefons nutzen, um Sprachnachrichten anzuzeigen, zu sortieren und wiederzugeben, und sogar die Sprachsteuerung von Cisco Unity Connection verwenden, um auf Cisco Unified MeetingPlace Express Meetings zuzugreifen.

Vulnerabilities 5

  • Medium 6.5
    CVE-2026-20078

    Cisco Unity Connection Arbitrary File Download Vulnerability

    Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker to download arbitrary files from an affected system. To exploit these vulnerabilities, the attacker must have valid administrative credentials.  These v…

    Cisco Cisco Unity Connection Network devices
  • Medium 6.5
    CVE-2026-20081

    Cisco Unity Connection Arbitrary File Download Vulnerability

    Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker to download arbitrary files from an affected system. To exploit these vulnerabilities, the attacker must have valid administrative credentials.  These v…

    Cisco Cisco Unity Connection Network devices
  • Medium 6.1
    CVE-2026-20059

    Cisco Unity Connection Reflected Cross-Site Scripting Vulnerability

    A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a reflected XSS attack against a user of the interface. This vulnerability exists because the web-based management inter…

    Cisco Cisco Unity Connection Network devices
  • Medium 4.7
    CVE-2026-20060

    Cisco Unity Connection Open Redirect Vulnerability

    A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of HTTP request parameters. An a…

    Cisco Cisco Unity Connection Network devices
  • Medium 4.3
    CVE-2026-20061

    Cisco Unity Connection SQL Injection Vulnerability

    A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to perform an SQL injection attack against an affected device. To exploit this vulnerability, the attacker must have valid user crede…

    Cisco Cisco Unity Connection Network devices

Revision history

  1. #1

    Initiale Fassung

References