A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to perform an SQL injection attack against an affected device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP(S) request to the web-based management interface of an affected device. A successful exploit could allow the attacker to view data on the affected device.
References
| Link | Resource |
|---|---|
| https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-unity-vulns-n2EJSbbw | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
28 Apr 2026, 16:30
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:cisco:unity_connection:*:*:*:*:*:*:*:* |
28 Apr 2026, 16:14
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Cisco
Cisco unity Connection |
|
| References | () https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-unity-vulns-n2EJSbbw - Vendor Advisory | |
| CPE | cpe:2.3:a:cisco:unity_connection:14su4:*:*:*:*:*:*:* cpe:2.3:a:cisco:unity_connection:12.5:*:*:*:*:*:*:* cpe:2.3:a:cisco:unity_connection:14.0:*:*:*:*:*:*:* cpe:2.3:a:cisco:unity_connection:14su3a:*:*:*:*:*:*:* cpe:2.3:a:cisco:unity_connection:14su5:*:*:*:*:*:*:* cpe:2.3:a:cisco:unity_connection:14su1:*:*:*:*:*:*:* cpe:2.3:a:cisco:unity_connection:14su2:*:*:*:*:*:*:* cpe:2.3:a:cisco:unity_connection:15su2:*:*:*:*:*:*:* cpe:2.3:a:cisco:unity_connection:15.0:*:*:*:*:*:*:* cpe:2.3:a:cisco:unity_connection:14su3:*:*:*:*:*:*:* cpe:2.3:a:cisco:unity_connection:15su3:*:*:*:*:*:*:* cpe:2.3:a:cisco:unity_connection:15su1:*:*:*:*:*:*:* |
15 Apr 2026, 17:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-15 17:17
Updated : 2026-04-28 16:30
NVD link : CVE-2026-20061
Mitre link : CVE-2026-20061
CVE.ORG link : CVE-2026-20061
JSON object : View
Products Affected
cisco
- unity_connection
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')