CVE-2026-20081

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-20081", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2025-10-08T11:59:15.363Z", "datePublished": "2026-04-15T16:03:23.282Z", "dateUpdated": "2026-04-15T17:06:37.914Z"}, "containers": {"cna": {"title": "Cisco Unity Connection Arbitrary File Download Vulnerability", "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}}], "descriptions": [{"lang": "en", "value": "Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker to download arbitrary files from an affected system. To exploit these vulnerabilities, the attacker must have valid administrative credentials. \r\n\r\nThese vulnerabilities are due to improper sanitization of user input to the web-based management interface. An attacker could exploit these vulnerabilities by sending a crafted HTTPS request. A successful exploit could allow the attacker to download arbitrary files from an affected system."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-unity-file-download-RmKEVWPx", "name": "cisco-sa-unity-file-download-RmKEVWPx"}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}], "source": {"advisory": "cisco-sa-unity-file-download-RmKEVWPx", "discovery": "EXTERNAL", "defects": ["CSCwr87730"]}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Relative Path Traversal", "type": "cwe", "cweId": "CWE-23"}]}], "affected": [{"vendor": "Cisco", "product": "Cisco Unity Connection", "versions": [{"version": "12.5(1)", "status": "affected"}, {"version": "12.5(1)SU1", "status": "affected"}, {"version": "12.5(1)SU2", "status": "affected"}, {"version": "12.5(1)SU3", "status": "affected"}, {"version": "12.5(1)SU4", "status": "affected"}, {"version": "14", "status": "affected"}, {"version": "12.5(1)SU5", "status": "affected"}, {"version": "14SU1", "status": "affected"}, {"version": "12.5(1)SU6", "status": "affected"}, {"version": "14SU2", "status": "affected"}, {"version": "12.5(1)SU7", "status": "affected"}, {"version": "14SU3", "status": "affected"}, {"version": "12.5(1)SU8", "status": "affected"}, {"version": "14SU3a", "status": "affected"}, {"version": "12.5(1)SU8a", "status": "affected"}, {"version": "15", "status": "affected"}, {"version": "15SU1", "status": "affected"}, {"version": "14SU4", "status": "affected"}, {"version": "12.5(1)SU9", "status": "affected"}, {"version": "15SU2", "status": "affected"}, {"version": "15SU3", "status": "affected"}, {"version": "14SU5", "status": "affected"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-04-15T16:03:23.282Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-20081", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T16:53:08.016233Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T17:06:37.914Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-20081", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T16:53:08.016233Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T16:56:34.848Z"}}], "cna": {"title": "Cisco Unity Connection Arbitrary File Download Vulnerability", "source": {"defects": ["CSCwr87730"], "advisory": "cisco-sa-unity-file-download-RmKEVWPx", "discovery": "EXTERNAL"}, "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Cisco", "product": "Cisco Unity Connection", "versions": [{"status": "affected", "version": "12.5(1)"}, {"status": "affected", "version": "12.5(1)SU1"}, {"status": "affected", "version": "12.5(1)SU2"}, {"status": "affected", "version": "12.5(1)SU3"}, {"status": "affected", "version": "12.5(1)SU4"}, {"status": "affected", "version": "14"}, {"status": "affected", "version": "12.5(1)SU5"}, {"status": "affected", "version": "14SU1"}, {"status": "affected", "version": "12.5(1)SU6"}, {"status": "affected", "version": "14SU2"}, {"status": "affected", "version": "12.5(1)SU7"}, {"status": "affected", "version": "14SU3"}, {"status": "affected", "version": "12.5(1)SU8"}, {"status": "affected", "version": "14SU3a"}, {"status": "affected", "version": "12.5(1)SU8a"}, {"status": "affected", "version": "15"}, {"status": "affected", "version": "15SU1"}, {"status": "affected", "version": "14SU4"}, {"status": "affected", "version": "12.5(1)SU9"}, {"status": "affected", "version": "15SU2"}, {"status": "affected", "version": "15SU3"}, {"status": "affected", "version": "14SU5"}], "defaultStatus": "unknown"}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-unity-file-download-RmKEVWPx", "name": "cisco-sa-unity-file-download-RmKEVWPx"}], "descriptions": [{"lang": "en", "value": "Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker to download arbitrary files from an affected system. To exploit these vulnerabilities, the attacker must have valid administrative credentials. \r\n\r\nThese vulnerabilities are due to improper sanitization of user input to the web-based management interface. An attacker could exploit these vulnerabilities by sending a crafted HTTPS request. A successful exploit could allow the attacker to download arbitrary files from an affected system."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "cwe", "cweId": "CWE-23", "description": "Relative Path Traversal"}]}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-04-15T16:03:23.282Z"}}}, "cveMetadata": {"cveId": "CVE-2026-20081", "state": "PUBLISHED", "dateUpdated": "2026-04-15T17:06:37.914Z", "dateReserved": "2025-10-08T11:59:15.363Z", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "datePublished": "2026-04-15T16:03:23.282Z", "assignerShortName": "cisco"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Cisco Unity Connection", "vendor": "Cisco", "versions": [{"status": "affected", "version": "12.5(1)"}, {"status": "affected", "version": "12.5(1)SU1"}, {"status": "affected", "version": "12.5(1)SU2"}, {"status": "affected", "version": "12.5(1)SU3"}, {"status": "affected", "version": "12.5(1)SU4"}, {"status": "affected", "version": "14"}, {"status": "affected", "version": "12.5(1)SU5"}, {"status": "affected", "version": "14SU1"}, {"status": "affected", "version": "12.5(1)SU6"}, {"status": "affected", "version": "14SU2"}, {"status": "affected", "version": "12.5(1)SU7"}, {"status": "affected", "version": "14SU3"}, {"status": "affected", "version": "12.5(1)SU8"}, {"status": "affected", "version": "14SU3a"}, {"status": "affected", "version": "12.5(1)SU8a"}, {"status": "affected", "version": "15"}, {"status": "affected", "version": "15SU1"}, {"status": "affected", "version": "14SU4"}, {"status": "affected", "version": "12.5(1)SU9"}, {"status": "affected", "version": "15SU2"}, {"status": "affected", "version": "15SU3"}, {"status": "affected", "version": "14SU5"}]}], "source": "psirt@cisco.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cisco:unity_connection:*:*:*:*:*:*:*:*", "matchCriteriaId": "6DAF417F-F480-4A4D-845B-8338776FF253", "versionEndIncluding": "12.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:unity_connection:14.0:*:*:*:*:*:*:*", "matchCriteriaId": "A85D56C0-D4A3-43A7-9CD1-FCEB6C8AEF66", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:unity_connection:14su1:*:*:*:*:*:*:*", "matchCriteriaId": "774C01A1-9328-45E8-9BDD-470A10BC3C2A", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:unity_connection:14su2:*:*:*:*:*:*:*", "matchCriteriaId": "CD8AB4B5-12C2-4F02-A4C3-4B8C06AFFD53", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:unity_connection:14su3:*:*:*:*:*:*:*", "matchCriteriaId": "181866CE-6279-4422-8EF8-7A12DB5B21F6", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:unity_connection:14su3a:*:*:*:*:*:*:*", "matchCriteriaId": "7B70BACC-B771-4049-8A55-3B277913DEEF", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:unity_connection:14su4:*:*:*:*:*:*:*", "matchCriteriaId": "D09F3655-B513-48F6-82A8-F0F946C52D25", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:unity_connection:14su5:*:*:*:*:*:*:*", "matchCriteriaId": "E51AF0FF-016D-4F20-8F88-0E70D18C375C", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:unity_connection:15.0:*:*:*:*:*:*:*", "matchCriteriaId": "97CC6719-1A7F-48BA-8014-802E235ED80D", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:unity_connection:15su1:*:*:*:*:*:*:*", "matchCriteriaId": "2C9412EC-282C-4926-83F8-932E24E0FC22", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:unity_connection:15su2:*:*:*:*:*:*:*", "matchCriteriaId": "37EFE547-7D3C-4D71-8D46-2C5734B9D64B", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:unity_connection:15su3:*:*:*:*:*:*:*", "matchCriteriaId": "CE6AF25B-E6F9-4E15-902D-4516DFE8C8E2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker to download arbitrary files from an affected system. To exploit these vulnerabilities, the attacker must have valid administrative credentials. \r\n\r\nThese vulnerabilities are due to improper sanitization of user input to the web-based management interface. An attacker could exploit these vulnerabilities by sending a crafted HTTPS request. A successful exploit could allow the attacker to download arbitrary files from an affected system."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades en Cisco Unity Connection podr\u00edan permitir a un atacante remoto autenticado descargar archivos arbitrarios de un sistema afectado. Para explotar estas vulnerabilidades, el atacante debe tener credenciales administrativas v\u00e1lidas.\n\nEstas vulnerabilidades se deben a una sanitizaci\u00f3n inadecuada de la entrada del usuario en la interfaz de gesti\u00f3n basada en web. Un atacante podr\u00eda explotar estas vulnerabilidades enviando una solicitud HTTPS manipulada. Un exploit exitoso podr\u00eda permitir al atacante descargar archivos arbitrarios de un sistema afectado."}], "id": "CVE-2026-20081", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "psirt@cisco.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20081", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-15T16:53:08.016233Z", "version": "2.0.3"}}]}, "published": "2026-04-15T17:17:01.783", "references": [{"source": "psirt@cisco.com", "tags": ["Vendor Advisory"], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-unity-file-download-RmKEVWPx"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-23"}], "source": "psirt@cisco.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "12.5(1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "12.5(1)SU1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "12.5(1)SU2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "12.5(1)SU3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "12.5(1)SU4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "14"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "12.5(1)SU5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "14SU1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "12.5(1)SU6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "14SU2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "12.5(1)SU7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "14SU3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "12.5(1)SU8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "14SU3a"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "12.5(1)SU8a"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "15"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "15SU1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "14SU4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "12.5(1)SU9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "15SU2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "15SU3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "14SU5"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": "Cisco Unity Connection", "source": "cna", "vendor": "Cisco"}, "product": "unity_connection", "vendor": "cisco"}], "analysis": {"en": {"generated_at": "2026-04-15T19:21:00.168193+00:00", "value": {"mitigation_remediation": ["Apply the latest Cisco Unity Connection patch or upgrade to a version that includes the fix.", "Restrict administrative access to trusted personnel and enforce strong, regularly changed passwords.", "Disable remote HTTPS management access unless it is essential for operations, and monitor the management interface for anomalous download attempts."], "summary": {"action": "Apply Patch", "impact": "Remote File Download"}, "threat_synthesis": {"affected_systems": "The flaw affects Cisco Unity Connection software. No specific version range is provided; any installation that has not applied the latest security updates may be vulnerable.", "description_and_impact": "This vulnerability allows an authenticated user with administrative privileges to download any file from a Cisco Unity Connection server. The flaw arises from inadequate sanitization of input to the web\u2011based administration interface, enabling a path traversal attack. An attacker who can send a crafted HTTPS request can cause the server to return the contents of arbitrary files, potentially exposing sensitive configuration or credential data.", "risk_and_exploitability": "The vulnerability carries a CVSS base score of 6.5, indicating a moderate impact. Exploitation requires valid administrative credentials and a remote HTTPS connection to the management interface. No exploit probability is available, and the vulnerability is not listed in CISA\u2019s Known Exploited Vulnerabilities catalog, suggesting that it has not yet been widely exploited. However, the ability to download arbitrary files poses significant confidentiality risks if administrative access is compromised."}}}}, "created": "2026-04-15T19:30:12.382399+00:00", "updated": "2026-04-15T20:45:06.101097+00:00", "vendors": ["cisco", "cisco$PRODUCT$unity_connection"]}