CVE-2026-20034

A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of a targeted device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.

• cisco unity connection (< 14.0) • cisco unity connection 14.0 • cisco unity connection 14su1 • cisco unity connection 14su2 • cisco unity connection 14su3 • cisco unity connection 14su4 • cisco unity connection 15.0 • cisco unity connection 15su1 • cisco unity connection 15su2 • cisco unity connection 15su3