What’s Vulnerable › Products

Cisco Unified Communications Manager vulnerabilities

251 known vulnerabilities, 3 confirmed exploited in the wild (CISA KEV), 19 published in the last 12 months.

Check whether your Cisco Unified Communications Manager version is affected

Exploited Cisco Unified Communications Manager vulnerabilities

• CVE-2026-20230 — Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability
• CVE-2026-20045 — Cisco Unified Communications Products Code Injection Vulnerability
• CVE-2021-44228 — Apache Log4j2 Remote Code Execution Vulnerability

Latest Cisco Unified Communications Manager vulnerabilities

• CVE-2026-76481 — Cisco Unified Communications Products Hardening Release: October 2026 - Improper Check or Handling of Exceptional Conditions Vulnerabilities (CVSS 7.5)
• CVE-2026-76487 — Cisco Unified Communications Manager Improper Access Control Vulnerability (CVSS 5.3)
• CVE-2026-76479 — Cisco Unified Communications Products Hardening Release: October 2026 - Path Traversal Vulnerabilities (CVSS 7.8)
• CVE-2026-76478 — Cisco Unified Communications Products Hardening Release: October 2026 - Improper Access Control Vulnerabilities (CVSS 8.8)
• CVE-2026-76476 — Cisco Unified Communications Products Hardening Release: October 2026 - Improper Input Validation Vulnerabilities (CVSS 8.8)
• CVE-2026-76477 — Cisco Unified Communications Products Hardening Release: October 2026 - Injection Vulnerabilities (CVSS 8.8)
• CVE-2026-76475 — Cisco Unified Communications Products Hardening Release: October 2026 - Cross-site Scripting Vulnerabilities (CVSS 9.3)
• CVE-2026-76474 — Cisco Unified Communications Products Hardening Release: October 2026 - Improper Authentication Vulnerabilities (CVSS 9.8)
• CVE-2026-76473 — Cisco Unified Communications Products Hardening Release: October 2026 - Improper control of a resource through its lifetime. (CVSS 9.8)
• CVE-2026-20230 — Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability (CVSS 8.6) — exploited
• CVE-2026-20045 — Cisco Unified Communications Products Code Injection Vulnerability (CVSS 9.8) — exploited
• CVE-2025-20361 — Cisco Unified Communications Manager Stored Cross-Site Scripting Vulnerability (CVSS 4.8)
• CVE-2025-20326 — Cisco Unified Communications Manager Cross-Site Request Forgery Vulnerability (CVSS 8.8)
• CVE-2025-20309 — Cisco Unified Communications Manager Static SSH Credentials Vulnerability (CVSS 10.0)
• CVE-2025-20278 — Cisco Unified Communications Products Command Injection Vulnerability (CVSS 6.7)
• CVE-2025-20112 — Cisco Unified Communications Products Privilege Escalation Vulnerability (CVSS 5.1)
• CVE-2020-3532 — Cisco Unified Communications Products Cross-Site Scripting Vulnerability (CVSS 6.1)
• CVE-2020-3420 — Cisco Unified Communications Manager Stored Cross-Site Scripting Vulnerability (CVSS 5.4)
• CVE-2024-20511 — Cisco Unified Communications Manager Cross-Site Scripting Vulnerability (CVSS 6.1)
• CVE-2024-20488 — Cisco Unified Communications Manager Cross-Site Scripting Vulnerability (CVSS 6.1)
• CVE-2024-20375 — (CVSS 7.5)
• CVE-2024-20253 — (CVSS 10.0)
• CVE-2023-20259 — (CVSS 7.5)
• CVE-2023-20266 — (CVSS 7.2)
• CVE-2023-20211 — (CVSS 8.8)