Home

Description

A vulnerability in the web UI of Cisco Unity Connection Web Inbox could allow an unauthenticated, remote attacker to conduct SSRF attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to send arbitrary network requests that are sourced from the affected device.

PUBLISHED Reserved 2025-10-08 | Published 2026-05-06 | Updated 2026-05-06 | Assigner cisco




HIGH: 7.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Problem types

Server-Side Request Forgery (SSRF)

Product status

Default status
unknown

12.5(1)
affected

12.5(1)SU1
affected

12.5(1)SU2
affected

12.5(1)SU3
affected

12.5(1)SU4
affected

14
affected

12.5(1)SU5
affected

14SU1
affected

12.5(1)SU6
affected

14SU2
affected

12.5(1)SU7
affected

14SU3
affected

12.5(1)SU8
affected

14SU3a
affected

12.5(1)SU8a
affected

15
affected

15SU1
affected

14SU4
affected

12.5(1)SU9
affected

15SU2
affected

15SU3
affected

References

sec.cloudapps.cisco.com/.../cisco-sa-unity-rce-ssrf-hENhuASy (cisco-sa-unity-rce-ssrf-hENhuASy)

cve.org (CVE-2026-20035)

nvd.nist.gov (CVE-2026-20035)

Download JSON