Cisco Unified Communications Manager IM and Presence Service vulnerabilities

Product

Cisco Unified Communications Manager IM and Presence Service

by Cisco · last CVE Oct 21, 2026

On CISA KEVExploited in the wild

CVEs

On KEV

10.0

Max CVSS

New 30D

Vulnerabilities23 In the news0 Timeline

Severity mix

Critical 5High 10Medium 8Low 0

Severity

All severities23 Critical5 High10 Medium8 Low0

Exploitation

On CISA KEV1 Exploited in the wild1

Watch

Add Cisco Unified Communications Manager IM and Presence Service to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-20045 In wildKEV	9.8	5%	Jan 21	Cisco Unified Communications Products Remote Code Execution Vulnerability Affected: 12.5(1); 12.5(1)SU1; 12.5(1)SU2; 12.5(1)SU3; 12.5(1)SU4; 14; +14 more
CVE-2024-20253	10.0	2%	Jan 26	A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute arbitrary code on an… Affected: 10.5(1); 10.5(2); 10.5(2a); 10.5(2b); 10.5(2)SU3; 10.5(2)SU2a; +34 more
CVE-2026-76474	9.8	0%	Oct 21	Cisco Unified Communications Products Hardening Release: October 2026 - Improper Authentication Vulnerabilities Affected: 14; 14SU1; 14SU2; 14SU2a; 14SU3; 15; +7 more
CVE-2026-76473	9.8	0%	Oct 21	Cisco Unified Communications Products Hardening Release: October 2026 - Improper control of a resource through its lifetime. Affected: 14; 14SU1; 14SU2; 14SU2a; 14SU3; 15; +7 more
CVE-2026-76475	9.3	0%	Oct 21	Cisco Unified Communications Products Hardening Release: October 2026 - Cross-site Scripting Vulnerabilities Affected: 14; 14SU1; 14SU2; 14SU2a; 14SU3; 15; +7 more
CVE-2026-76478	8.8	0%	Oct 21	Cisco Unified Communications Products Hardening Release: October 2026 - Improper Access Control Vulnerabilities Affected: 14; 14SU1; 14SU2; 14SU2a; 14SU3; 15; +7 more
CVE-2026-76476	8.8	0%	Oct 21	Cisco Unified Communications Products Hardening Release: October 2026 - Improper Input Validation Vulnerabilities Affected: 14; 14SU1; 14SU2; 14SU2a; 14SU3; 15; +7 more
CVE-2026-76477	8.8	0%	Oct 21	Cisco Unified Communications Products Hardening Release: October 2026 - Injection Vulnerabilities Affected: 14; 14SU1; 14SU2; 14SU2a; 14SU3; 15; +7 more
CVE-2022-20786	8.1	1%	Apr 21	Cisco Unified Communications Manager IM & Presence Service SQL Injection Vulnerability Affected: All versions, or not specified
CVE-2021-1363	8.1	1%	May 6	Cisco Unified Communications Manager IM & Presence Service SQL Injection Vulnerabilities Affected: All versions, or not specified
CVE-2021-1365	8.1	1%	May 6	Cisco Unified Communications Manager IM & Presence Service SQL Injection Vulnerabilities Affected: All versions, or not specified
CVE-2026-76479	7.8	0%	Oct 21	Cisco Unified Communications Products Hardening Release: October 2026 - Path Traversal Vulnerabilities Affected: 14; 14SU1; 14SU2; 14SU2a; 14SU3; 15; +7 more
CVE-2026-76481	7.5	0%	Oct 21	Cisco Unified Communications Products Hardening Release: October 2026 - Improper Check or Handling of Exceptional Conditions Vulnerabilities Affected: 14; 14SU1; 14SU2; 14SU2a; 14SU3; 15; +7 more
CVE-2023-20259	7.5	1%	Oct 4	A vulnerability in an API endpoint of multiple Cisco Unified Communications Products could allow an unauthenticated, remote attacker to cause high CPU utilization, which could… Affected: 12.5(1)SU7; 14SU3
CVE-2023-20108	7.5	1%	Jun 28	A vulnerability in the XCP Authentication Service of the Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an unauthenticated,… Affected: 10.5(1); 10.5(2); 10.5(2a); 10.5(2b); 10.5(2)SU3; 10.5(2)SU2a; +34 more
CVE-2025-20278	6.7	0%	Jun 4	Cisco Unified Communications Products Command Injection Vulnerability Affected: 12.5(1); 12.5(1)SU1; 12.5(1)SU2; 12.5(1)SU3; 12.5(1)SU4; 14; +13 more
CVE-2024-20457	6.5	0%	Nov 6	Cisco Unified Communications Manager IM & Presence Service Information Disclosure Vulnerability Affected: 11.5(1)SU6; 10.5(1)SU1; 10.5(1)SU2; 12.5(1); 10.5(2)SU2a; 11.5(1)SU3a; +34 more
CVE-2020-27121	6.5	1%	Nov 6	Cisco Unified Communications Manager IM and Presence Service Denial of Service Vulnerability Affected: All versions, or not specified
CVE-2025-20330	6.1	0%	Sep 3	Cisco Unified Communications Manager IM and Presence Cross-Site Scripting Vulnerability Affected: 12.5(1); 12.5(1)SU1; 12.5(1)SU2; 12.5(1)SU3; 12.5(1)SU4; 14; +13 more
CVE-2020-3532	6.1	1%	Nov 18	Cisco Unified Communications Products Cross-Site Scripting Vulnerability Affected: All versions, or not specified
CVE-2024-20310	6.1	0%	Apr 3	A vulnerability in the web-based interface of Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an unauthenticated, remote attacker to… Affected: 10.5(1); 10.5(2); 10.5(2a); 10.5(2b); 10.5(2)SU3; 10.5(2)SU2a; +34 more
CVE-2023-20242	6.1	0%	Aug 16	A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified CM Session Management Edition (Unified CM SME), and Cisco… Affected: All versions, or not specified
CVE-2025-20112	5.1	0%	May 21	Cisco Unified Communications Products Privilege Escalation Vulnerability Affected: 12.5(1); 12.5(1)SU1; 12.5(1)SU2; 12.5(1)SU3; 12.5(1)SU4; 14; +12 more