Vulnerabilità ed exploit

Cisco Unity Connection Bugs Expose Admin Web Sessions

Cisco Unity Connection’s web management interface can be abused to run script in an admin’s browser or send users to a malicious site. The standard response is to treat this as a low-grade web bug, but on a management plane that handles voice infrastructure, browser compromise can expose privileged sessions and internal admin workflows.

Cisco says CVE-2026-20059 is a reflected XSS flaw and CVE-2026-20060 is an open redirect flaw. Both affect Cisco Unity Connection and are fixed in vendor software updates; Cisco says there are no workarounds.

The immediate risk is not service outage. It is that an attacker can turn a trusted admin link into a session-theft or lure path against the people who manage the system.

3 fonti · 16 apr

Cronologia

• 16 apr Segnalato da Cisco PSIRT

Fonti

• 16 apr Cisco PSIRT

  Cisco Security Advisory: Cisco Webex Services Certificate Validation Vulnerability

  Cisco has addressed this vulnerability in the Cisco Webex service.

  originale

• 16 apr The Hacker News

  Cisco Patches Four Critical Identity Services, Webex Flaws Enabling Code Execution

  Cisco patches four CVEs up to CVSS 9.9 in ISE and Webex, preventing code execution and user impersonation risks.

  originale

• 16 apr SecurityWeek

  Cisco Patches Critical Vulnerabilities in Webex, ISE

  The flaws can be exploited remotely to impersonate users or execute arbitrary commands on the underlying OS.

  originale

Riepilogo fornitore: Cisco

Part of the PlainSec briefing for 2026-04-16

Every edition of this story: Cisco Unity Connection Bugs Expose Admin Web Sessions

Altro da oggi

• Nginx UI’s MCP Endpoint Opens Full Server Takeover
• Windows Task Host Flaw Gives Local Users SYSTEM
• Old Excel RCE Returns to CISA’s Exploited List