Aller au contenu
en Se connecter
8.2 Élevée Exploitée

CVE-2026-20045 Cisco Unified Communications Products Code Injection Vulnerability

Exploitation active constatée

· catalogue CISA KEV
Action attendue Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Campagnes de rançongiciel Non constatée à ce jour
Faiblesse CWE-94

Description

A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device.  This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root.  Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.

Produits et versions touchés

Produit Versions touchées Corrigé en
Cisco Unified Communications Manager 15.0 15.0.1.13010-1 → 15.0.1.13017-1 Pas de correctif indiqué
Cisco Unified Communications Manager 15 15SU1a → 15 Pas de correctif indiqué
Cisco Unified Communications Manager 14 14SU1 → 14 Pas de correctif indiqué
Cisco Unified Communications Manager IM and Presence Service 15 15SU1 → 15 Pas de correctif indiqué
Cisco Unified Communications Manager IM and Presence Service 14 14SU1 → 14 Pas de correctif indiqué
Cisco Unity Connection 15 15SU1 → 15 Pas de correctif indiqué
Cisco Unity Connection 14 14SU1 → 14 Pas de correctif indiqué

Références

Chronologie

  1. Publiée
  2. Ajoutée au catalogue KEV
  3. Dernière modification

Autres CVE de Cisco Unified Communications Manager

Les 62 CVE de Cisco Unified Communications Manager →
CVE-2026-76419 Cisco Unified Communications Manager Cross-Site Scripting Vulnerability 6.1 Moyenne CVE-2026-76481 As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency… 7.5 Élevée CVE-2026-76487 A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session… 5.3 Moyenne CVE-2026-76479 As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency… 7.8 Élevée
Suivre cette CVE