CVE-2026-20035
High
Description
A vulnerability in the web UI of Cisco Unity Connection Web Inbox could allow an unauthenticated, remote attacker to conduct SSRF attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to send arbitrary network requests that are sourced from the affected device.
SeverityHigh
CVSS7.2
Exploit probability—
Product
Cisco Unity Connection
PublishedMay 6, 2026
First seenMay 6, 2026
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Update
- cisco unity_connection14.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco unity_connection | v < 14.0, 14.0, 14su1, 14su2, 14su3, 14su4, 15.0, 15su1, 15su2, 15su3 | 14.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.