cisco-sa-unity-rce-ssrf-hENhuASyHighCVSS 8.8

Cisco Unity Connection Remote Code Execution and Server-Side Request Forgery Vulnerabilities

Published
May 6, 2026
Last Modified
May 6, 2026

🔗 CVE IDs covered (2)

CVE-2026-20034 →CVE-2026-20035 →

📋 Description

Multiple vulnerabilities in Cisco Unity Connection could allow a remote attacker to execute arbitrary code on or conduct server-side request forgery (SSRF) attacks through an affected device.

For more information about these vulnerabilities, see the Details ["#details"] section of this advisory.

Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.

CVE-2026-20034 — Cisco Unity Connection Remote Code Execution Vulnerability (CVSS 3.1 8.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) CVE-2026-20035 — Cisco Unity Connection Server-Side Request Forgery Vulnerability (CVSS 3.1 7.2, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)

🎯 Affected products22

  • Cisco Unity Connection
  • Cisco Unity Connection 12.5(1)
  • Cisco Unity Connection 12.5(1)SU1
  • Cisco Unity Connection 12.5(1)SU2
  • Cisco Unity Connection 12.5(1)SU3
  • Cisco Unity Connection 12.5(1)SU4
  • Cisco Unity Connection 12.5(1)SU5
  • Cisco Unity Connection 12.5(1)SU6
  • Cisco Unity Connection 12.5(1)SU7
  • Cisco Unity Connection 12.5(1)SU8
  • Cisco Unity Connection 12.5(1)SU8a
  • Cisco Unity Connection 12.5(1)SU9
  • Cisco Unity Connection 14
  • Cisco Unity Connection 14SU1
  • Cisco Unity Connection 14SU2
  • Cisco Unity Connection 14SU3
  • Cisco Unity Connection 14SU3a
  • Cisco Unity Connection 14SU4
  • Cisco Unity Connection 15
  • Cisco Unity Connection 15SU1
  • Cisco Unity Connection 15SU2
  • Cisco Unity Connection 15SU3

✅ Remediation

Cisco has released software updates that address this vulnerability. https://software.cisco.com Workarounds: There are no workarounds that address these vulnerabilities.

🔗 References (5)