Unity Connection
Vendor:
First CVE: Mar 1, 2012 · Active for 14 years
65
Total CVEs
More Total CVEs than 98% of tracked products
4.3
Avg CVEs / Year
Higher CVE frequency than 86% of tracked products
6.6
Avg CVSS
Higher Avg CVSS than 32% of tracked products
3.1%
KEV Rate
Higher KEV Rate than 97% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Unity Connection over time
Volume of CVEsAvg CVSS Base Score
First CVE
Mar 1, 2012
14 years ago
Most Recent CVE
May 6, 2026
80 days ago
CVE Severity & Scoring
Unity Connection65 CVEs
66%
26%
All CVEs352,427 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local1 (1.5%)
Network42 (64.6%)
Unknown22 (33.8%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low43 (66.2%)
High0 (0.0%)
Unknown22 (33.8%)
User Interaction
None24 (36.9%)
Unknown22 (33.8%)
Required19 (29.2%)
Privileges Required
Low9 (13.8%)
High7 (10.8%)
None27 (41.5%)
Unknown22 (33.8%)
Top CVEs
Signals from CVEs in this product scope (65 CVEs).
65 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-44228CRITICAL Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect agai | Dec 10, 2021 | 10.0 | 99 | YES | YES |
CVE-2026-20045CRITICAL A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications | Jan 21, 2026 | 9.8 | 77 | YES | NO |
CVE-2026-20034HIGH A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to execute arbitrary code on an affected device.
Th | May 6, 2026 | 8.8 | 39 | NO | NO |
CVE-2017-12337CRITICAL A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Operating System software platform could allow an unauthenticated, remote attacker | Nov 16, 2017 | 9.8 | 33 | NO | NO |
CVE-2026-20035HIGH A vulnerability in the web UI of Cisco Unity Connection Web Inbox could allow an unauthenticated, remote attacker to conduct SSRF attacks through an affected device.
This vulner | May 6, 2026 | 7.2 | 32 | NO | NO |
CVE-2024-20253CRITICAL A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute arbitrary code on an affec | Jan 26, 2024 | 10.0 | 31 | NO | NO |
CVE-2024-20272CRITICAL A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system and | Jan 17, 2024 | 9.8 | 31 | NO | NO |
CVE-2021-1362HIGH A vulnerability in the SOAP API endpoint of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Mana | Apr 8, 2021 | 8.8 | 28 | NO | NO |
CVE-2022-20859HIGH A vulnerability in the Disaster Recovery framework of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM | Jul 6, 2022 | 8.8 | 27 | NO | NO |
CVE-2014-3333HIGH The server in Cisco Unity Connection 9.1(1) and 9.1(2) allows remote authenticated users to obtain privileged access by conducting an "HTTP Intercept" attack and leveraging the abi | Aug 11, 2014 | 9.0 | 27 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (65 CVEs).
CISA KEV
2 CVEs
3.1% of CVEs· 97th percentile
Metasploit
1 CVE
1.5% of CVEs· 96th percentile
Nuclei
1 CVE
1.5% of CVEs· 96th percentile
ExploitDB
1 CVE
1.5% of CVEs· 87th percentile
Social Chatter
Signals from CVEs in this product scope (65 CVEs).
Media Mentions
Signals from CVEs in this product scope (65 CVEs).
Top CNAs Publishing CVEs For Unity Connection
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| vmo-11.5\(1\) | 1 | 4.8 | 0.9% | 0 | 0 |
| 9.5\(0.9\)tt0 | 1 | 7.5 | 2.0% | 0 | 0 |
| 9.5 | 2 | 6.4 | 1.3% | 0 | 0 |
| 9.1\(2\) | 9 | 7.2 | 2.6% | 0 | 0 |
| 9.1\(1\)es23 | 1 | 5.4 | 1.2% | 0 | 0 |
| 9.1\(1.10\) | 2 | 5.9 | 4.8% | 0 | 0 |
| 9.1\(1\) | 9 | 7.2 | 2.6% | 0 | 0 |
| 9.1.1 | 1 | 5.0 | 1.2% | 0 | 0 |
| 9.1 | 1 | 5.0 | 1.2% | 0 | 0 |
| 9.0\(1\) | 6 | 7.2 | 2.8% | 0 | 0 |
| 9.0 | 2 | 6.4 | 1.3% | 0 | 0 |
| 8.6_base | 5 | 7.2 | 3.0% | 0 | 0 |
| 8.6\(2a\)su3 | 6 | 7.2 | 2.8% | 0 | 0 |
| 8.6\(2a\)su2 | 6 | 7.2 | 2.8% | 0 | 0 |
| 8.6\(2a\)su1 | 6 | 7.2 | 2.8% | 0 | 0 |
| 8.6\(2a\) | 7 | 6.8 | 2.5% | 0 | 0 |
| 8.6\(2\) | 6 | 7.2 | 2.8% | 0 | 0 |
| 8.6\(1a\) | 8 | 6.9 | 2.5% | 0 | 0 |
| 8.6\(1\) | 6 | 7.2 | 2.8% | 0 | 0 |
| 8.6 | 3 | 5.3 | 1.4% | 0 | 0 |