Known vulnerabilities in Cisco Unified Communications Manager

Vendor: Cisco Systems, Inc
Software: Cisco Unified Communications Manager
Software CPE: cpe:2.3:a:cisco_systems:cisco_unified_communications_manager:*:*:*:*:*:*:*:*
Website: https://www.cisco.com
Total vulnerabilities: 31
Public exploits: 1
Known exploited (KEV): 2
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Cisco Unified Communications Manager Cisco Unified Communications Manager is affected by 31 known vulnerabilities: 3 critical, 2 high, 8 medium, 18 low Critical High Medium Low

Vulnerabilities (31)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU133306 - Server-Side Request Forgery (SSRF)
CVE-2026-20230		 CWE-918 Critical
No
Exploited
 14SU6 04.06.2026 SB2026060401
#VU121911 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-20045		 CWE-94 Critical
Available
Exploited
 14SU5 21.01.2026 SB2026012157
#VU116387 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-20361		 CWE-79 Low
No
No
 15SU3 02.10.2025 SB2025100209
#VU114777 - Cross-Site Request Forgery (CSRF)
CVE-2025-20326		 CWE-352 Low
No
No
 15SU3 04.09.2025 SB2025090417
#VU112113 - Use of Hard-coded Credentials
CVE-2025-20309		 CWE-798 Critical
No
No
 - 02.07.2025 SB2025070287
#VU110238 - Command injection
CVE-2025-20278		 CWE-77 Low
No
No
 15SU2 06.06.2025 SB2025060643
#VU109651 - Privilege Chaining
CVE-2025-20112		 CWE-268 Low
No
No
 CCM.014.000(001.15900.006), CCM.015.000(000.96000.012), CCM.015.000(000.96000.013), CCM.015.000(000.96000.014), CCM.015.000(001.12821.002), CCM.015.000(001.12830.009), CCM.015.000(001.12840.007), CCM.015.000(001.12891.002), CCM.015.000(001.12900.135), CCM.015.000(001.12900.234), CCM.015.000(001.13009.001), CUC.014.000(001.15900.007), CUC.015.000(001.12900.016), CUC.015.000(001.13003.003), CUP.014.000(001.15000.011), CUP.015.000(000.96000.007), CUP.015.000(001.11999.004), CUP.015.000(001.11999.005), CUP.015.000(001.11999.006), CUP.015.000(001.11999.007), CUP.015.000(001.12000.013), CUP.015.000(001.13020.001), UCMAP.015.000(001.12900.021), UCMAP.015.000(001.12999.001), UCMAP.015.000(001.12999.002), 015.000(001.12900.025), 015.000(001.12999.002) 22.05.2025 SB2025052222
#VU100050 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-20511		 CWE-79 Low
No
No
 15SU2 07.11.2024 SB2024110737
#VU96375 - Out-of-bounds write
CVE-2024-20375		 CWE-787 Medium
No
No
 12.5(1)SU9, 14SU4, 15SU1 21.08.2024 SB20240821117
#VU96374 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-20488		 CWE-79 Low
No
No
 15SU1 21.08.2024 SB20240821117
#VU85776 - Deserialization of Untrusted Data
CVE-2024-20253		 CWE-502 High
No
No
 - 24.01.2024 SB2024012480
#VU81671 - Improper input validation
CVE-2023-20259		 CWE-20 High
No
No
 12.5(1)SU8 06.10.2023 SB2023100607
#VU80178 - Permissions, Privileges, and Access Controls
CVE-2023-20266		 CWE-264 Low
No
No
 12.5.1SU8a 31.08.2023 SB2023083111
#VU79948 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2023-20211		 CWE-89 Medium
No
No
 12.5(1)SU8 24.08.2023 SB2023082428
#VU79942 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-20242		 CWE-79 Low
No
No
 12.5(1)SU8, 14SU4 24.08.2023 SB2023082423
#VU77086 - Improper input validation
CVE-2023-20116		 CWE-20 Medium
No
No
 12.5(1)SU8, 14SU3 08.06.2023 SB2023060811
#VU71331 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2023-20010		 CWE-89 Medium
No
No
 12.5(1)SU7 18.01.2023 SB2023011899
#VU66111 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2022-20816		 CWE-22 Medium
No
No
 14SU2 04.08.2022 SB2022080429
#VU64952 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-20815		 CWE-79 Low
No
No
 11.5(1)SU11, 12.5(1)SU6, 14SU2 06.07.2022 SB2022070621
#VU64951 - Permissions, Privileges, and Access Controls
CVE-2022-20791		 CWE-264 Low
No
No
 14SU2 06.07.2022 SB2022070621


Showing elements 1 - 20 out of 31