CVE-2026-20034Disclosure(cisco / unity_connection)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch cisco unity_connection systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of a targeted device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.

cisco CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-unity-rce-ssrf-hENhuASy

Weakness type (CWE)

CWE-35

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

unity_connection

Threat summary

Patch or workaround signal is available
7 mentions across 5 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 5 signals
Disclosure: 5 classified signals
Peaked 3d ago at 3 mentions (2026-05-07); latest day: 1
7 total mentions across 5 days

Affected systems

Vendors

cisco

Products

unity_connection

9 versions affected across 1 product

Deep dive

Activity timeline7 mentions / 5d

Signal classification2 categories

Disclosure

571.4%

Patch

228.6%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-06	1	Disclosure1
2026-05-07	3	Disclosure1Patch2
2026-05-08	1	Disclosure1
2026-05-14	1	Disclosure1
2026-05-18	1	Disclosure1

Full discourse7 posts

CCB Alert@CCBalert155d
Disclosure
Warning: Two high severity #vulnerabilities in #Cisco Unity Connection. While #CVE-2026-20034 CVSS: 8.8 could lead to arbitrary code execution #RCE, #CVE-2026-20035 CVSS: 7.2 allows a remote attacker to conduct Server-Side Request Forgery #SSRF attacks. #Patch #Patch #Patch
Post summary
The text warns of two high‑severity Cisco Unity Connection vulnerabilities—CVE‑2026‑20034 (RCE, CVSS 8.8) and CVE‑2026‑20035 (SSRF, CVSS 7.2)—and indicates that patches are available.
00020334
7.2K followersView on X
Gray Hats@the_yellow_fall157d
Patch
Cisco warns of critical RCE (CVE-2026-20034) and SSRF flaws in Unity Connection. Authenticated root access and unauthenticated network probing are possible. Patch now! #Cisco #CyberSecurity #InfoSec #RCE #SSRF #UnityConnection #Vulnerability #RootAccess https://securityonline.info/cisco-unity-connection-rce-ssrf-vulnerabilities-cve-2026-20034/ https://t.co/r2QCQdXjDM
Post summary
Cisco highlights critical RCE and SSRF vulnerabilities in Unity Connection, advises immediate patching, and notes potential for authenticated root access and unauthenticated probing.
00011423
11.7K followersView on X
Autumn Good@autumn_good_35156d
Disclosure
CVE-2026-20034 CVE-2026-20035 Cisco Unity Connection Remote Code Execution and Server-Side Request Forgery Vulnerabilities https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-unity-rce-ssrf-hENhuASy
Post summary
Cisco released a security advisory for CVE-2026-20034 and CVE-2026-20035, identifying Remote Code Execution and SSRF vulnerabilities in Unity Connection, but no PoC, exploit code, or active exploitation claims were provided.
00010351
6.8K followersView on X
CERT-PY@CERTpy145d
Disclosure
⚠️ Vulnerabilidades en productos Cisco ❗ CVE-2026-20185 ❗ CVE-2026-20167 ❗ CVE-2026-20034 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-cisco-15/ https://t.co/713Xur4qkJ
Post summary
Three new Cisco CVEs are listed and readers are directed to external links for further information.
00000145
6.7K followersView on X
UWillC@uwillc150d
Disclosure
Cisco PSIRT May 6 bundle: 6 advisories. Headlines: ISE auth-bypass CVE-2026-20193 (CVSS 4.3, Medium). The one nobody read: CVE-2026-20034 Unity Connection RCE-as-root (CVSS 8.8, High, no workaround). If you rank by SIR alone, you missed it. http://netdevops-tools.thebackroom.ai
Post summary
The tweet announces Cisco PSIRT advisories for two CVEs, providing basic vulnerability details but no mention of PoC, exploitation, or mitigation.
0000094
499 followersView on X
America's Pick@nims213157d
Patch
Cisco Patches High-Severity Vulnerabilities in Enterprise Products https://ift.tt/cBW39tp Cisco on Wednesday announced patches for multiple vulnerabilities across its enterprise products, including five high-severity bugs. Two high-severity issues, tracked as CVE-2026-20034…
Post summary
Cisco has announced patch releases for several high‑severity vulnerabilities in its enterprise products, but the post provides no details on exploits, technical specifics, or active attacks.
0000046
1.7K followersView on X
CVE@CVEnew157d
Disclosure
CVE-2026-20034 A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to execute arbitrary code on an affected… https://www.cve.org/CVERecord?id=CVE-2026-20034
Post summary
The entry references the newly disclosed CVE‑2026‑20034, noting it permits authenticated remote code execution on Cisco Unity Connection, but offers no PoC, exploit code, patch, or evidence of active exploitation.
00000114
57.4K followersView on X

CPE platform detail10 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

10 of 10 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	cisco	unity_connection	-	-	-
App	cisco	unity_connection	14.0	-	-
App	cisco	unity_connection	14su1	-	-
App	cisco	unity_connection	14su2	-	-
App	cisco	unity_connection	14su3	-	-
App	cisco	unity_connection	14su4	-	-
App	cisco	unity_connection	15.0	-	-
App	cisco	unity_connection	15su1	-	-
App	cisco	unity_connection	15su2	-	-
App	cisco	unity_connection	15su3	-	-

Explore more

Back to dashboard cisco CVEs unity_connection vulnerabilities

What researchers are saying

CVE-2026-20034

America's Pick[verified]@nims213Patch

Cisco has announced patch releases for several high‑severity vulnerabilities in its enterprise products, but the post provides no details on exploits, technical specifics, or active attacks.

CCB Alert@CCBalertDisclosure

The text warns of two high‑severity Cisco Unity Connection vulnerabilities—CVE‑2026‑20034 (RCE, CVSS 8.8) and CVE‑2026‑20035 (SSRF, CVSS 7.2)—and indicates that patches are available.

Gray Hats@the_yellow_fallPatch

Cisco highlights critical RCE and SSRF vulnerabilities in Unity Connection, advises immediate patching, and notes potential for authenticated root access and unauthenticated probing.

Autumn Good@autumn_good_35Disclosure

Cisco released a security advisory for CVE-2026-20034 and CVE-2026-20035, identifying Remote Code Execution and SSRF vulnerabilities in Unity Connection, but no PoC, exploit code, or active exploitation claims were provided.

CERT-PY@CERTpyDisclosure

Three new Cisco CVEs are listed and readers are directed to external links for further information.

UWillC@uwillcDisclosure

The tweet announces Cisco PSIRT advisories for two CVEs, providing basic vulnerability details but no mention of PoC, exploitation, or mitigation.

CVE@CVEnewDisclosure

The entry references the newly disclosed CVE‑2026‑20034, noting it permits authenticated remote code execution on Cisco Unity Connection, but offers no PoC, exploit code, patch, or evidence of active exploitation.