{"cvss":4.7,"datePublished":"2026-04-15T17:17:01.250","dateUpdated":"2026-10-26T21:10:00.170","description":"A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to redirect a user to a malicious web page.\r\n\r\nThis vulnerability is due to improper input validation of HTTP request parameters. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious web page.","id":"CVE-2026-20060","raw":{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"Cisco Unity Connection","vendor":"Cisco","versions":[{"status":"affected","version":"14"},{"status":"affected","version":"14SU1"},{"status":"affected","version":"14SU2"},{"status":"affected","version":"14SU3"},{"status":"affected","version":"14SU3a"},{"status":"affected","version":"15"},{"status":"affected","version":"15SU1"},{"status":"affected","version":"14SU4"},{"status":"affected","version":"15SU2"},{"status":"affected","version":"15SU3"}]}],"source":"psirt@cisco.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:cisco:unity_connection:*:*:*:*:*:*:*:*","matchCriteriaId":"6DAF417F-F480-4A4D-845B-8338776FF253","versionEndIncluding":"12.5","vulnerable":true},{"criteria":"cpe:2.3:a:cisco:unity_connection:14.0:*:*:*:*:*:*:*","matchCriteriaId":"A85D56C0-D4A3-43A7-9CD1-FCEB6C8AEF66","vulnerable":true},{"criteria":"cpe:2.3:a:cisco:unity_connection:14su1:*:*:*:*:*:*:*","matchCriteriaId":"774C01A1-9328-45E8-9BDD-470A10BC3C2A","vulnerable":true},{"criteria":"cpe:2.3:a:cisco:unity_connection:14su2:*:*:*:*:*:*:*","matchCriteriaId":"CD8AB4B5-12C2-4F02-A4C3-4B8C06AFFD53","vulnerable":true},{"criteria":"cpe:2.3:a:cisco:unity_connection:14su3:*:*:*:*:*:*:*","matchCriteriaId":"181866CE-6279-4422-8EF8-7A12DB5B21F6","vulnerable":true},{"criteria":"cpe:2.3:a:cisco:unity_connection:14su3a:*:*:*:*:*:*:*","matchCriteriaId":"7B70BACC-B771-4049-8A55-3B277913DEEF","vulnerable":true},{"criteria":"cpe:2.3:a:cisco:unity_connection:14su4:*:*:*:*:*:*:*","matchCriteriaId":"D09F3655-B513-48F6-82A8-F0F946C52D25","vulnerable":true},{"criteria":"cpe:2.3:a:cisco:unity_connection:15.0:*:*:*:*:*:*:*","matchCriteriaId":"97CC6719-1A7F-48BA-8014-802E235ED80D","vulnerable":true},{"criteria":"cpe:2.3:a:cisco:unity_connection:15su1:*:*:*:*:*:*:*","matchCriteriaId":"2C9412EC-282C-4926-83F8-932E24E0FC22","vulnerable":true},{"criteria":"cpe:2.3:a:cisco:unity_connection:15su2:*:*:*:*:*:*:*","matchCriteriaId":"37EFE547-7D3C-4D71-8D46-2C5734B9D64B","vulnerable":true},{"criteria":"cpe:2.3:a:cisco:unity_connection:15su3:*:*:*:*:*:*:*","matchCriteriaId":"CE6AF25B-E6F9-4E15-902D-4516DFE8C8E2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to redirect a user to a malicious web page.\r\n\r\nThis vulnerability is due to improper input validation of HTTP request parameters. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious web page."},{"lang":"es","value":"Una vulnerabilidad en la interfaz de gestión basada en web de Cisco Unity Connection podría permitir a un atacante remoto no autenticado redirigir a un usuario a una página web maliciosa.\n\nEsta vulnerabilidad se debe a una validación de entrada incorrecta de los parámetros de solicitud HTTP. Un atacante podría explotar esta vulnerabilidad persuadiendo a un usuario para que haga clic en un enlace manipulado. Un exploit exitoso podría permitir al atacante redirigir a un usuario a una página web maliciosa."}],"id":"CVE-2026-20060","lastModified":"2026-10-26T21:10:00.170","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"psirt@cisco.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.7,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-20060","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-15T16:42:33.155641Z","version":"2.0.3"}}]},"published":"2026-04-15T17:17:01.250","references":[{"source":"psirt@cisco.com","tags":["Vendor Advisory"],"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-unity-vulns-n2EJSbbw"}],"sourceIdentifier":"psirt@cisco.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"psirt@cisco.com","type":"Secondary"}]},"severity":"MEDIUM","source":"nvd","title":"A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remot..."}