CVE-2026-20034

A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of a targeted device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.

• CWE-35

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-unity-rce-ssrf-hENhuASyVendor Advisory

Published

May 6, 2026

Last Modified

Jul 1, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-20027Multiple Cisco products are affected by a vulnerability in t…5.3
• CVE-2026-20028A vulnerability in the network driver of Cisco Terminal Serv…5
• CVE-2026-20029A vulnerability in the licensing features of Cisco Iden…4.9
• CVE-2026-2003Improper validation of type "oidvector" in PostgreSQL allows…4.3
• CVE-2026-20031A vulnerability in the HTML Cascading Style Sheets (CSS) mod…5.3
• CVE-2026-20033A vulnerability in Cisco Nexus 9000 Series Fabric Switches i…7.4
• CVE-2026-20035A vulnerability in the web UI of Cisco Unity Connection Web …7.2
• CVE-2026-20036A vulnerability in the CLI and web-based management interfac…6.5
• CVE-2026-20037A vulnerability in the NX-OS CLI privilege levels of Cisco U…4.4
• CVE-2026-20039A vulnerability in the VPN web server of Cisco Secure Firewa…8.6
• CVE-2026-2004Missing validation of type of input in PostgreSQL intarray e…8.8
• CVE-2026-20040A vulnerability in the CLI of Cisco IOS XR Software could al…8.8