Cisco Unity Connection Vulnerabilities Enable Code Execution and SSRF Attacks

• •Cisco identified critical vulnerabilities in Unity Connection allowing code execution and SSRF.
• •Patches have been released for CVE-2026-20034 and CVE-2026-20035 to address these issues.
• •Affected products include Unity Connection, Managed Switches, and IoT Field Network Director.

Cisco has released security advisories addressing multiple high-severity vulnerabilities in its Unity Connection product. The most critical flaws allow authenticated attackers to inject and execute malicious code through manipulated API requests, while unauthenticated actors can perform Server-Side Request Forgery (SSRF) attacks. Additionally, vulnerabilities in Cisco's Managed Switches and IoT Field Network Director could lead to Denial-of-Service attacks. Cisco has issued patches for these vulnerabilities, with CVE-2026-20034 and CVE-2026-20035 being particularly noteworthy. The flaws affect various enterprise products, posing significant risks to organizations using these systems. Administrators are advised to apply the patches promptly to mitigate potential exploits.