Vulnerabilità · 167 giorni fa

Cisco Unity Connection Bugs Expose Admin Web Sessions

Cisco Unity Connection’s web management interface can be abused to run script in an admin’s browser or send users to a malicious site. The standard response is to treat this as a low-grade web bug, but on a management plane that handles voice infrastructure, browser compromise can expose privileged sessions and internal admin workflows.

Cisco says CVE-2026-20059 is a reflected XSS flaw and CVE-2026-20060 is an open redirect flaw. Both affect Cisco Unity Connection and are fixed in vendor software updates; Cisco says there are no workarounds.

The immediate risk is not service outage. It is that an attacker can turn a trusted admin link into a session-theft or lure path against the people who manage the system.

Cronologia

• 16 apr Segnalato da Cisco PSIRT

Fonti

3 fonti che coprono questa storia

• Cisco PSIRT 16 apr

  Cisco Security Advisory: Cisco Webex Services Certificate Validation Vulnerability

  Cisco has addressed this vulnerability in the Cisco Webex service.

• The Hacker News 16 apr

  Cisco Patches Four Critical Identity Services, Webex Flaws Enabling Code Execution

  Cisco patches four CVEs up to CVSS 9.9 in ISE and Webex, preventing code execution and user impersonation risks.

• SecurityWeek 16 apr

  Cisco Patches Critical Vulnerabilities in Webex, ISE

  The flaws can be exploited remotely to impersonate users or execute arbitrary commands on the underlying OS.

• Cisco PSIRT 15 apr

  Cisco Security Advisory: Cisco Identity Services Engine Remote Code Execution and Path Traversal Vulnerabilities

  Cisco has released software updates that address these vulnerabilities.

• Cisco PSIRT 15 apr

  Cisco Security Advisory: Cisco Identity Services Engine Multiple Cross-Site Scripting Vulnerabilities

  Cisco has released software updates that address these vulnerabilities.

• Cisco PSIRT 15 apr

  Cisco Security Advisory: Cisco Identity Services Engine Remote Code Execution Vulnerabilities

  Cisco has released software updates that address these vulnerabilities.

• Cisco PSIRT 15 apr

  Cisco Security Advisory: Cisco Unity Connection Arbitrary File Download Vulnerabilities

  Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker to download arbitrary files from an affected system.

• Cisco PSIRT 15 apr

  Cisco Security Advisory: Cisco Identity Services Engine Authenticated Privilege Escalation Vulnerability

  Cisco has released software updates that address this vulnerability.

• Cisco PSIRT 15 apr

  Cisco Security Advisory: Cisco Webex Contact Center Cross-Site Scripting Vulnerability

  Cisco has addressed this vulnerability in the Cisco Webex Contact Center service, and no customer action is needed.

• Cisco PSIRT 15 apr

  Cisco Security Advisory: Cisco Unity Connection Cross-Site Scripting, Open Redirect, and SQL Injection Vulnerabilities

  Multiple vulnerabilities in Cisco Unity Connection could allow a remote attacker to conduct a cross-site scripting (XSS) attack, an open redirect attack, and an SQL injection attack.

Entità

• CVE-2026-20059
• CVE-2026-20060

Riepilogo fornitore: Cisco

Part of the PlainSec briefing for 2026-04-16

Editions

• Briefing for 2026-04-16

Storie correlate

• Nginx UI’s MCP Endpoint Opens Full Server Takeover
• Windows Task Host Flaw Gives Local Users SYSTEM
• Old Excel RCE Returns to CISA’s Exploited List