{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-20081", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2025-10-08T11:59:15.363Z", "datePublished": "2026-04-15T16:03:23.282Z", "dateUpdated": "2026-04-15T17:06:37.914Z"}, "containers": {"cna": {"title": "Cisco Unity Connection Arbitrary File Download Vulnerability", "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}}], "descriptions": [{"lang": "en", "value": "Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker to download arbitrary files from an affected system. To exploit these vulnerabilities, the attacker must have valid administrative credentials. \r\n\r\nThese vulnerabilities are due to improper sanitization of user input to the web-based management interface. An attacker could exploit these vulnerabilities by sending a crafted HTTPS request. A successful exploit could allow the attacker to download arbitrary files from an affected system."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-unity-file-download-RmKEVWPx", "name": "cisco-sa-unity-file-download-RmKEVWPx"}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}], "source": {"advisory": "cisco-sa-unity-file-download-RmKEVWPx", "discovery": "EXTERNAL", "defects": ["CSCwr87730"]}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Relative Path Traversal", "type": "cwe", "cweId": "CWE-23"}]}], "affected": [{"vendor": "Cisco", "product": "Cisco Unity Connection", "versions": [{"version": "12.5(1)", "status": "affected"}, {"version": "12.5(1)SU1", "status": "affected"}, {"version": "12.5(1)SU2", "status": "affected"}, {"version": "12.5(1)SU3", "status": "affected"}, {"version": "12.5(1)SU4", "status": "affected"}, {"version": "14", "status": "affected"}, {"version": "12.5(1)SU5", "status": "affected"}, {"version": "14SU1", "status": "affected"}, {"version": "12.5(1)SU6", "status": "affected"}, {"version": "14SU2", "status": "affected"}, {"version": "12.5(1)SU7", "status": "affected"}, {"version": "14SU3", "status": "affected"}, {"version": "12.5(1)SU8", "status": "affected"}, {"version": "14SU3a", "status": "affected"}, {"version": "12.5(1)SU8a", "status": "affected"}, {"version": "15", "status": "affected"}, {"version": "15SU1", "status": "affected"}, {"version": "14SU4", "status": "affected"}, {"version": "12.5(1)SU9", "status": "affected"}, {"version": "15SU2", "status": "affected"}, {"version": "15SU3", "status": "affected"}, {"version": "14SU5", "status": "affected"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-04-15T16:03:23.282Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-20081", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T16:53:08.016233Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T17:06:37.914Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-20081", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2025-10-08T11:59:15.363Z", "datePublished": "2026-04-15T16:03:23.282Z", "dateUpdated": "2026-04-15T16:03:23.282Z"}, "containers": {"cna": {"title": "Cisco Unity Connection Arbitrary File Download Vulnerability", "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}}], "descriptions": [{"lang": "en", "value": "Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker to download arbitrary files from an affected system. To exploit these vulnerabilities, the attacker must have valid administrative credentials. \r\n\r\nThese vulnerabilities are due to improper sanitization of user input to the web-based management interface. An attacker could exploit these vulnerabilities by sending a crafted HTTPS request. A successful exploit could allow the attacker to download arbitrary files from an affected system."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-unity-file-download-RmKEVWPx", "name": "cisco-sa-unity-file-download-RmKEVWPx"}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}], "source": {"advisory": "cisco-sa-unity-file-download-RmKEVWPx", "discovery": "EXTERNAL", "defects": ["CSCwr87730"]}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Relative Path Traversal", "type": "cwe", "cweId": "CWE-23"}]}], "affected": [{"vendor": "Cisco", "product": "Cisco Unity Connection", "versions": [{"version": "12.5(1)", "status": "affected"}, {"version": "12.5(1)SU1", "status": "affected"}, {"version": "12.5(1)SU2", "status": "affected"}, {"version": "12.5(1)SU3", "status": "affected"}, {"version": "12.5(1)SU4", "status": "affected"}, {"version": "14", "status": "affected"}, {"version": "12.5(1)SU5", "status": "affected"}, {"version": "14SU1", "status": "affected"}, {"version": "12.5(1)SU6", "status": "affected"}, {"version": "14SU2", "status": "affected"}, {"version": "12.5(1)SU7", "status": "affected"}, {"version": "14SU3", "status": "affected"}, {"version": "12.5(1)SU8", "status": "affected"}, {"version": "14SU3a", "status": "affected"}, {"version": "12.5(1)SU8a", "status": "affected"}, {"version": "15", "status": "affected"}, {"version": "15SU1", "status": "affected"}, {"version": "14SU4", "status": "affected"}, {"version": "12.5(1)SU9", "status": "affected"}, {"version": "15SU2", "status": "affected"}, {"version": "15SU3", "status": "affected"}, {"version": "14SU5", "status": "affected"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-04-15T16:03:23.282Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-20081", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T16:53:08.016233Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-04-15T16:56:34.848Z"}, "title": "CISA ADP Vulnrichment"}]}}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker to download arbitrary files from an affected system. To exploit these vulnerabilities, the attacker must have valid administrative credentials. \r\n\r\nThese vulnerabilities are due to improper sanitization of user input to the web-based management interface. An attacker could exploit these vulnerabilities by sending a crafted HTTPS request. A successful exploit could allow the attacker to download arbitrary files from an affected system."}], "id": "CVE-2026-20081", "lastModified": "2026-04-15T17:17:01.783", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "psirt@cisco.com", "type": "Primary"}]}, "published": "2026-04-15T17:17:01.783", "references": [{"source": "psirt@cisco.com", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-unity-file-download-RmKEVWPx"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-23"}], "source": "psirt@cisco.com", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-15T19:21:00.168193+00:00", "value": {"mitigation_remediation": ["Apply the latest Cisco Unity Connection patch or upgrade to a version that includes the fix.", "Restrict administrative access to trusted personnel and enforce strong, regularly changed passwords.", "Disable remote HTTPS management access unless it is essential for operations, and monitor the management interface for anomalous download attempts."], "summary": {"action": "Apply Patch", "impact": "Remote File Download"}, "threat_synthesis": {"affected_systems": "The flaw affects Cisco Unity Connection software. No specific version range is provided; any installation that has not applied the latest security updates may be vulnerable.", "description_and_impact": "This vulnerability allows an authenticated user with administrative privileges to download any file from a Cisco Unity Connection server. The flaw arises from inadequate sanitization of input to the web\u2011based administration interface, enabling a path traversal attack. An attacker who can send a crafted HTTPS request can cause the server to return the contents of arbitrary files, potentially exposing sensitive configuration or credential data.", "risk_and_exploitability": "The vulnerability carries a CVSS base score of 6.5, indicating a moderate impact. Exploitation requires valid administrative credentials and a remote HTTPS connection to the management interface. No exploit probability is available, and the vulnerability is not listed in CISA\u2019s Known Exploited Vulnerabilities catalog, suggesting that it has not yet been widely exploited. However, the ability to download arbitrary files poses significant confidentiality risks if administrative access is compromised."}}}}, "created": "2026-04-15T19:30:12.382399+00:00", "updated": "2026-04-15T19:30:12.382409+00:00", "vendors": []}