{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-20078", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2025-10-08T11:59:15.363Z", "datePublished": "2026-04-15T16:03:16.698Z", "dateUpdated": "2026-04-15T17:06:38.080Z"}, "containers": {"cna": {"title": "Cisco Unity Connection Arbitrary File Download Vulnerability", "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}}], "descriptions": [{"lang": "en", "value": "Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker to download arbitrary files from an affected system. To exploit these vulnerabilities, the attacker must have valid administrative credentials. \r\n\r\nThese vulnerabilities are due to improper sanitization of user input to the web-based management interface. An attacker could exploit these vulnerabilities by sending a crafted HTTPS request. A successful exploit could allow the attacker to download arbitrary files from an affected system."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-unity-file-download-RmKEVWPx", "name": "cisco-sa-unity-file-download-RmKEVWPx"}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}], "source": {"advisory": "cisco-sa-unity-file-download-RmKEVWPx", "discovery": "EXTERNAL", "defects": ["CSCwq36816"]}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Relative Path Traversal", "type": "cwe", "cweId": "CWE-23"}]}], "affected": [{"vendor": "Cisco", "product": "Cisco Unity Connection", "versions": [{"version": "12.5(1)", "status": "affected"}, {"version": "12.5(1)SU1", "status": "affected"}, {"version": "12.5(1)SU2", "status": "affected"}, {"version": "12.5(1)SU3", "status": "affected"}, {"version": "12.5(1)SU4", "status": "affected"}, {"version": "14", "status": "affected"}, {"version": "12.5(1)SU5", "status": "affected"}, {"version": "14SU1", "status": "affected"}, {"version": "12.5(1)SU6", "status": "affected"}, {"version": "14SU2", "status": "affected"}, {"version": "12.5(1)SU7", "status": "affected"}, {"version": "14SU3", "status": "affected"}, {"version": "12.5(1)SU8", "status": "affected"}, {"version": "14SU3a", "status": "affected"}, {"version": "12.5(1)SU8a", "status": "affected"}, {"version": "15", "status": "affected"}, {"version": "15SU1", "status": "affected"}, {"version": "14SU4", "status": "affected"}, {"version": "12.5(1)SU9", "status": "affected"}, {"version": "15SU2", "status": "affected"}, {"version": "15SU3", "status": "affected"}, {"version": "14SU5", "status": "affected"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-04-15T16:03:16.698Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-20078", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T16:53:33.414429Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T17:06:38.080Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-20078", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2025-10-08T11:59:15.363Z", "datePublished": "2026-04-15T16:03:16.698Z", "dateUpdated": "2026-04-15T16:03:16.698Z"}, "containers": {"cna": {"title": "Cisco Unity Connection Arbitrary File Download Vulnerability", "metrics": [{"format": "cvssV3_1", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}}], "descriptions": [{"lang": "en", "value": "Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker to download arbitrary files from an affected system. To exploit these vulnerabilities, the attacker must have valid administrative credentials. \r\n\r\nThese vulnerabilities are due to improper sanitization of user input to the web-based management interface. An attacker could exploit these vulnerabilities by sending a crafted HTTPS request. A successful exploit could allow the attacker to download arbitrary files from an affected system."}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-unity-file-download-RmKEVWPx", "name": "cisco-sa-unity-file-download-RmKEVWPx"}], "exploits": [{"lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory."}], "source": {"advisory": "cisco-sa-unity-file-download-RmKEVWPx", "discovery": "EXTERNAL", "defects": ["CSCwq36816"]}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Relative Path Traversal", "type": "cwe", "cweId": "CWE-23"}]}], "affected": [{"vendor": "Cisco", "product": "Cisco Unity Connection", "versions": [{"version": "12.5(1)", "status": "affected"}, {"version": "12.5(1)SU1", "status": "affected"}, {"version": "12.5(1)SU2", "status": "affected"}, {"version": "12.5(1)SU3", "status": "affected"}, {"version": "12.5(1)SU4", "status": "affected"}, {"version": "14", "status": "affected"}, {"version": "12.5(1)SU5", "status": "affected"}, {"version": "14SU1", "status": "affected"}, {"version": "12.5(1)SU6", "status": "affected"}, {"version": "14SU2", "status": "affected"}, {"version": "12.5(1)SU7", "status": "affected"}, {"version": "14SU3", "status": "affected"}, {"version": "12.5(1)SU8", "status": "affected"}, {"version": "14SU3a", "status": "affected"}, {"version": "12.5(1)SU8a", "status": "affected"}, {"version": "15", "status": "affected"}, {"version": "15SU1", "status": "affected"}, {"version": "14SU4", "status": "affected"}, {"version": "12.5(1)SU9", "status": "affected"}, {"version": "15SU2", "status": "affected"}, {"version": "15SU3", "status": "affected"}, {"version": "14SU5", "status": "affected"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2026-04-15T16:03:16.698Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-20078", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T16:53:33.414429Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-04-15T16:56:36.853Z"}, "title": "CISA ADP Vulnrichment"}]}}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker to download arbitrary files from an affected system. To exploit these vulnerabilities, the attacker must have valid administrative credentials. \r\n\r\nThese vulnerabilities are due to improper sanitization of user input to the web-based management interface. An attacker could exploit these vulnerabilities by sending a crafted HTTPS request. A successful exploit could allow the attacker to download arbitrary files from an affected system."}], "id": "CVE-2026-20078", "lastModified": "2026-04-15T17:17:01.610", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "psirt@cisco.com", "type": "Primary"}]}, "published": "2026-04-15T17:17:01.610", "references": [{"source": "psirt@cisco.com", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-unity-file-download-RmKEVWPx"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-23"}], "source": "psirt@cisco.com", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-15T19:21:16.500003+00:00", "value": {"mitigation_remediation": ["Apply the Cisco-provided firmware or patch update that resolves the file download issue.", "Restrict administrative access to the web-based management interface to trusted IP ranges or a VPN and enforce strong authentication such as two\u2011factor authentication.", "If the web management interface is not required for daily operations, disable it or change its port to reduce exposure."], "summary": {"action": "Patch", "impact": "Arbitrary file download by authenticated attackers"}, "threat_synthesis": {"affected_systems": "All Cisco Unity Connection installations that have not been updated to the latest patch are affected; the advisory does not specify individual release numbers, so any running version prior to the vendor\u2019s fix is potentially vulnerable.", "description_and_impact": "Cisco Unity Connection is vulnerable due to improper sanitization of user input in its web management interface, allowing an authenticated attacker to request and download any file on the affected system. The flaw is classified as CWE\u201123, Directory Traversal, and can expose sensitive configuration files, client data, or credentials, thereby compromising confidentiality.", "risk_and_exploitability": "The CVSS score of 6.5 indicates moderate severity, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting no widespread exploitation has been reported. However, exploitation requires valid administrative credentials and a crafted HTTPS request, so the attack surface is restricted to users with privileged access. Once authenticated, the attacker can download arbitrary files without any additional escalation, making the risk significant for environments that store sensitive data on the Unity Connection server."}}}}, "created": "2026-04-15T19:30:12.382621+00:00", "updated": "2026-04-15T19:30:12.382631+00:00", "vendors": []}