CVE-2026-20034 – Cisco Unity Connection
“A single crafted request can turn a trusted account into full system control.”
This patch addresses a remote code execution vulnerability in the web-based management interface of Cisco Unity Connection. The issue stems from insufficient validation of user-supplied input, allowing authenticated attackers to submit crafted API requests that execute arbitrary code on the system. Successful exploitation can grant root-level access, leading to full compromise of the affected device.
CVE-2026-20034 has a CVSS score of 8.8, which is High severity.
There is no verified evidence of active exploitation or public proof-of-concept code. However, the vulnerability allows remote code execution with low complexity and high impact, making it a serious risk for environments where user credentials may be exposed or reused.
Key Details
- Affected Product
- Cisco Unity Connection
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- Low
- User Interaction
- None
- CWE Classification
- CWE-35