CVE-2026-20034

Analyzed Analyzed - Analysis Complete

Remote Code Execution in Cisco Unity Connection

Publication date: 2026-05-06

Last updated on: 2026-07-01

Assigner: Cisco Systems, Inc.

Description

A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of a targeted device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-06

Last Modified

2026-07-01

Generated

2026-07-06

AI Q&A

2026-05-06

EPSS Evaluated

2026-07-05

NVD

CVE-2026-20034

EUVD

EUVD-2026-27847

Affected Vendors & Products

Vendor	Product	Version / Range
cisco	unity_connection	14.0
cisco	unity_connection	to 14.0 (exc)
cisco	unity_connection	14su3
cisco	unity_connection	14su2
cisco	unity_connection	14su1
cisco	unity_connection	14su4
cisco	unity_connection	15.0
cisco	unity_connection	15su1
cisco	unity_connection	15su2
cisco	unity_connection	15su3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-35	The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the web-based management interface of Cisco Unity Connection. It allows an authenticated remote attacker to execute arbitrary code on the affected device by submitting a specially crafted API request. The root cause is insufficient validation of user-supplied input, which enables the attacker to run code with root privileges, potentially leading to full device compromise.

Impact Analysis

If exploited, this vulnerability can allow an attacker with valid credentials to execute arbitrary code as root on the affected device. This could result in complete compromise of the device, including unauthorized access, data manipulation, disruption of services, and potential further attacks within the network.

Compliance Impact

The vulnerability allows an authenticated, remote attacker to execute arbitrary code as root on the affected Cisco Unity Connection device, potentially leading to complete compromise of the device.

Such a compromise could result in unauthorized access to sensitive data or disruption of services, which may impact compliance with data protection standards and regulations like GDPR and HIPAA that require safeguarding of personal and health information.

However, the provided information does not explicitly describe the direct effects on compliance with these standards.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade to the fixed software releases provided by Cisco for Cisco Unity Connection, such as versions 14SU5, 15SU4, or apply the specific patch file for version 15.0.

There are no available workarounds, so applying the official updates is the recommended immediate step to prevent exploitation.

Hi! I’m here to help you understand CVE-2026-20034. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70