CVE-2026-20035 HIGH

CVE-2026-20035: Cisco Unity Connection Server-Side Request Forgery Vulnerability

Vendor Cisco
Product Cisco Unity Connection
Weakness CWE-918 · SSRF
Published May 6, 2026
Last update May 6, 2026
View on NVD All CVEs

CVSS base score

7.2/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

A vulnerability in the web UI of Cisco Unity Connection Web Inbox could allow an unauthenticated, remote attacker to conduct SSRF attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to send arbitrary network requests that are sourced from the affected device.

Key dates

02Disclosure timeline

May 6, 2026 CVE published
May 6, 2026 Record updated