Unified Communications Manager vulnerabilities

12 known vulnerabilities in Unified Communications Manager from Cisco. 12 are rated high or critical, and 2 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.6 High severity

  Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Exploited

  CVE-2026-20230Jun 3, 2026CiscoEPSS 88.5%

  A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks thro

• 9.8 Critical severity

  Cisco Unified Communications Products Code Injection Exploited

  CVE-2026-20045Jan 21, 2026CiscoEPSS 4.54%

  A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection

• 8.8 High severity

  Cisco Unified Communications Manager: Cross-Site Request Forgery

  CVE-2025-20326Sep 3, 2025Cisco

  A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) Software and Cisco Unified CM Session Management Edition (SME) Software could allow an unauthenticated, remote attacker to conduct a cross-site request f

• 10.0 Critical severity

  Cisco Unified Communications Manager: Use of Hard-coded Credentials

  CVE-2025-20309Jul 2, 2025CiscoEPSS 1.19%

  A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to log in to an affected device using the root account, wh

• 7.5 High severity

  Cisco Unified Communications Manager: Out-of-bounds Write

  CVE-2024-20375Aug 21, 2024Cisco

  A vulnerability in the SIP call processing function of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to cause a denial of s

• 10.0 Critical severity

  Cisco Unified Contact Center Enterprise: Deserialization of Untrusted Data

  CVE-2024-20253Jan 26, 2024CiscoEPSS 2.4%

  A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to the improper processing of user-provide

• 7.5 High severity

  Cisco Emergency Responder: Uncontrolled Resource Consumption

  CVE-2023-20259Oct 4, 2023Cisco

  A vulnerability in an API endpoint of multiple Cisco Unified Communications Products could allow an unauthenticated, remote attacker to cause high CPU utilization, which could impact access to the web-based management interface and cause delays with call proce

• 7.2 High severity

  Cisco Emergency Responder: Improper Privilege Management

  CVE-2023-20266Aug 30, 2023Cisco

  A vulnerability in Cisco Emergency Responder, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection could allow an authenticated, remote attacker to eleva

• 8.8 High severity

  Cisco Unified Communications Manager: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2023-20211Aug 16, 2023Cisco

  A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to conduct SQL injecti

• 8.8 High severity

  Cisco Unified Communications Manager: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2023-20010Jan 20, 2023Cisco

  A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to conduct SQL injecti

• 8.1 High severity

  Cisco Unified Communications Manager: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2022-20816Aug 10, 2022CiscoEPSS 1.3%

  A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to delete arbitrary fi

• 8.8 High severity

  Cisco Unified Communications Manager: Improper Access Control

  CVE-2022-20859Jul 6, 2022CiscoEPSS 1.3%

  A vulnerability in the Disaster Recovery framework of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), and Cisco Unity Connection could allow an authenticated, remote attac