Unified Communications Manager
Vendor:
First CVE: Jul 15, 2007 · Active for 19 years
239
Total CVEs
More Total CVEs than 100% of tracked products
11.9
Avg CVEs / Year
Higher CVE frequency than 97% of tracked products
6.5
Avg CVSS
Higher Avg CVSS than 36% of tracked products
1.3%
KEV Rate
Higher KEV Rate than 97% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Unified Communications Manager over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jul 15, 2007
19 years ago
Most Recent CVE
Jun 3, 2026
55 days ago
CVE Severity & Scoring
Unified Communications Manager239 CVEs
60%
37%
All CVEs353,173 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local3 (1.3%)
Network100 (41.8%)
Unknown135 (56.5%)
Physical0 (0.0%)
Adjacent Network1 (0.4%)
Attack Complexity
Low104 (43.5%)
High0 (0.0%)
Unknown135 (56.5%)
User Interaction
None58 (24.3%)
Unknown135 (56.5%)
Required46 (19.2%)
Privileges Required
Low33 (13.8%)
High9 (3.8%)
None62 (25.9%)
Unknown135 (56.5%)
Top CVEs
Signals from CVEs in this product scope (239 CVEs).
239 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-44228CRITICAL Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect agai | Dec 10, 2021 | 10.0 | 99 | YES | YES |
CVE-2026-20230HIGH A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthentic | Jun 3, 2026 | 8.6 | 97 | YES | NO |
CVE-2026-20045CRITICAL A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications | Jan 21, 2026 | 9.8 | 77 | YES | NO |
CVE-2011-3315HIGH Directory traversal vulnerability in Cisco Unified Communications Manager (CUCM) 5.x and 6.x before 6.1(5)SU2, 7.x before 7.1(5b)SU2, and 8.x before 8.0(3), and Cisco Unified Conta | Oct 27, 2011 | 7.8 | 59 | NO | YES |
CVE-2008-0027HIGH Heap-based buffer overflow in the Certificate Trust List (CTL) Provider service (CTLProvider.exe) in Cisco Unified Communications Manager (CUCM) 4.2 before 4.2(3)SR3 and 4.3 before | Jan 17, 2008 | 10.0 | 59 | NO | NO |
CVE-2013-5528MEDIUM Directory traversal vulnerability in the Tomcat administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to read arbitrary files via d | Oct 11, 2013 | 4.0 | 46 | NO | YES |
CVE-2011-1609HIGH SQL injection vulnerability in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5)su2, 7.x before 7.1(5)su1, 8.0 before 8.0(3), and 8.5 before 8 | May 3, 2011 | 8.5 | 44 | NO | YES |
CVE-2007-4634HIGH Multiple SQL injection vulnerabilities in Cisco CallManager and Unified Communications Manager (CUCM) before 3.3(5)sr2b, 4.1 before 4.1(3)sr5, 4.2 before 4.2(3)sr2, and 4.3 before | Aug 31, 2007 | 9.3 | 36 | NO | YES |
CVE-2017-12337CRITICAL A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Operating System software platform could allow an unauthenticated, remote attacker | Nov 16, 2017 | 9.8 | 33 | NO | NO |
CVE-2013-7030HIGH The TFTP service in Cisco Unified Communications Manager (aka CUCM or Unified CM) allows remote attackers to obtain sensitive information from a phone via an RRQ operation, as demo | Dec 12, 2013 | 7.3 | 33 | NO | YES |
Exploit Exposure
Signals from CVEs in this product scope (239 CVEs).
CISA KEV
3 CVEs
1.3% of CVEs· 97th percentile
Metasploit
1 CVE
0.4% of CVEs· 96th percentile
Nuclei
3 CVEs
1.3% of CVEs· 96th percentile
ExploitDB
9 CVEs
3.8% of CVEs· 85th percentile
Social Chatter
Signals from CVEs in this product scope (239 CVEs).
Media Mentions
Signals from CVEs in this product scope (239 CVEs).
Top CNAs Publishing CVEs For Unified Communications Manager
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 9.9\(9\)st1.9 | 1 | 7.5 | 8.3% | 0 | 0 |
| 9.1\(2.10000.28\) | 2 | 5.5 | 1.9% | 0 | 0 |
| 9.1\(2\) | 3 | 6.3 | 1.1% | 0 | 0 |
| 9.1\(1a\) | 2 | 8.2 | 2.5% | 0 | 0 |
| 9.1.1\(a\) | 7 | 7.1 | 1.2% | 0 | 0 |
| 9.1\(1\) | 9 | 7.0 | 1.1% | 0 | 0 |
| 9.0\(1\) | 15 | 6.7 | 1.3% | 0 | 0 |
| 8.6_base | 1 | 4.3 | 1.9% | 0 | 0 |
| 8.6\(4\) | 11 | 6.3 | 1.2% | 0 | 0 |
| 8.6\(3\) | 11 | 6.3 | 1.3% | 0 | 0 |
| 8.6\(2a\)su3 | 11 | 6.3 | 1.3% | 0 | 0 |
| 8.6\(2a\)su2 | 14 | 6.7 | 1.4% | 0 | 0 |
| 8.6\(2a\)su1 | 15 | 6.7 | 1.4% | 0 | 0 |
| 8.6\(2a\) | 17 | 6.8 | 1.4% | 0 | 0 |
| 8.6\(2\) | 17 | 6.8 | 1.4% | 0 | 0 |
| 8.6.2 | 1 | 4.3 | 1.9% | 0 | 0 |
| 8.6\(1a\) | 17 | 6.8 | 1.4% | 0 | 0 |
| 8.6\(1\) | 17 | 6.8 | 1.4% | 0 | 0 |
| 8.6.1 | 1 | 4.3 | 1.9% | 0 | 0 |
| 8.6 | 18 | 6.9 | 1.4% | 0 | 0 |