CVE-2026-20060

CVE-2026-20060 is an open redirect vulnerability affecting Cisco Unity Connection's web-based management interface. The flaw stems from improper input validation of HTTP request parameters, allowing an unauthenticated remote attacker to redirect users to malicious websites through crafted links. This vulnerability requires user interaction, as victims must click a malicious link to be redirected. The vulnerability carries a CVSS 3.1 score of 4.7 (medium severity) with a network-based attack vector and low complexity. No authentication is required for exploitation, though successful attacks depend on user interaction. The impact is limited to integrity compromise, with no confidentiality or availability impact expected. There is currently no evidence of active exploitation. The vulnerability does not appear on CISA's Known Exploited Vulnerabilities list and has not generated significant community attention. With an EPSS score of 0.00022, the probability of exploitation in the wild remains very low at this time.