Cisco Unified Communications Manager vulnerabilities

20 known vulnerabilities in Cisco Unified Communications Manager from Cisco. 20 are rated high or critical, and 2 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Cisco Emergency Responder: Improper Check or Handling of Exceptional Conditions

  CVE-2026-76481Oct 21, 2026Cisco

  As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &

• 7.8 High severity

  Cisco Emergency Responder: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-76479Oct 21, 2026Cisco

  As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &

• 8.8 High severity

  Cisco Emergency Responder: Improper Access Control

  CVE-2026-76478Oct 21, 2026Cisco

  As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &

• 8.8 High severity

  Cisco Emergency Responder: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-76477Oct 21, 2026Cisco

  As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &

• 8.8 High severity

  As part of Cisco's ongoing commitment to proactive security and product quality, engineering…

  CVE-2026-76476Oct 21, 2026Cisco

  As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &

• 9.3 Critical severity

  Cisco Emergency Responder: Improper Neutralization of Input During Web Page Generation

  CVE-2026-76475Oct 21, 2026Cisco

  As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &

• 9.8 Critical severity

  Cisco Emergency Responder: Improper Authentication

  CVE-2026-76474Oct 21, 2026Cisco

  As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &

• 9.8 Critical severity

  Cisco Emergency Responder: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2026-76473Oct 21, 2026Cisco

  As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &

• 8.6 High severity

  Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Exploited

  CVE-2026-20230Jun 3, 2026CiscoEPSS 88.5%

  A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks thro

• 9.8 Critical severity

  Cisco Unified Communications Products Code Injection Exploited

  CVE-2026-20045Jan 21, 2026CiscoEPSS 4.54%

  A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection

• 8.8 High severity

  Cisco Unified Communications Manager: Cross-Site Request Forgery

  CVE-2025-20326Sep 3, 2025Cisco

  A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) Software and Cisco Unified CM Session Management Edition (SME) Software could allow an unauthenticated, remote attacker to conduct a cross-site request f

• 10.0 Critical severity

  Cisco Unified Communications Manager: Use of Hard-coded Credentials

  CVE-2025-20309Jul 2, 2025CiscoEPSS 1.19%

  A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to log in to an affected device using the root account, wh

• 7.5 High severity

  Cisco Unified Communications Manager: Out-of-bounds Write

  CVE-2024-20375Aug 21, 2024Cisco

  A vulnerability in the SIP call processing function of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to cause a denial of s

• 10.0 Critical severity

  Cisco Unified Contact Center Enterprise: Deserialization of Untrusted Data

  CVE-2024-20253Jan 26, 2024CiscoEPSS 2.4%

  A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to the improper processing of user-provide

• 7.5 High severity

  Cisco Emergency Responder: Uncontrolled Resource Consumption

  CVE-2023-20259Oct 4, 2023Cisco

  A vulnerability in an API endpoint of multiple Cisco Unified Communications Products could allow an unauthenticated, remote attacker to cause high CPU utilization, which could impact access to the web-based management interface and cause delays with call proce

• 7.2 High severity

  Cisco Emergency Responder: Improper Privilege Management

  CVE-2023-20266Aug 30, 2023Cisco

  A vulnerability in Cisco Emergency Responder, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection could allow an authenticated, remote attacker to eleva

• 8.8 High severity

  Cisco Unified Communications Manager: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2023-20211Aug 16, 2023Cisco

  A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to conduct SQL injecti

• 8.8 High severity

  Cisco Unified Communications Manager: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2023-20010Jan 20, 2023Cisco

  A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to conduct SQL injecti

• 8.1 High severity

  Cisco Unified Communications Manager: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2022-20816Aug 10, 2022CiscoEPSS 1.3%

  A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to delete arbitrary fi

• 8.8 High severity

  Cisco Unified Communications Manager: Improper Access Control

  CVE-2022-20859Jul 6, 2022CiscoEPSS 1.3%

  A vulnerability in the Disaster Recovery framework of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), and Cisco Unity Connection could allow an authenticated, remote attac