Unified Communications Manager vulnerabilities | LiveThreat CVE Feed

Product

Unified Communications Manager

by Cisco · last CVE Jun 3, 2026

On CISA KEVExploited in the wild

238

CVEs

On KEV

10.0

Max CVSS

New 30D

Vulnerabilities238 In the news7 Timeline

Severity mix

Critical 4High 24Medium 75Low 0

Severity

All severities238 Critical4 High24 Medium75 Low0

Exploitation

On CISA KEV2 Exploited in the wild2

Watch

Add Unified Communications Manager to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2016-9206	6.1	2%	Dec 14	A vulnerability in the ccmadmin page of Cisco Unified Communications Manager (CUCM) could allow an unauthenticated, remote attacker to conduct reflected cross-site scripting (XSS)… Affected: 11.5(1.10000.6)
CVE-2016-6472	6.1	2%	Nov 19	A vulnerability in several parameters of the ccmivr page of Cisco Unified Communication Manager (CallManager) could allow an unauthenticated, remote attacker to launch a… Affected: 11.5(1.2)
CVE-2023-20116	5.7	1%	Jun 28	A vulnerability in the Administrative XML Web Service (AXL) API of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management… Affected: 11.5(1.10000.6); 11.5(1.10000.6); 12.0(1.10000.10); 12.0(1.10000.10); 12.5(1.10000.22); 12.5(1.10000.22); +2 more
CVE-2020-3420	5.4	0%	Nov 18	Cisco Unified Communications Manager Stored Cross-Site Scripting Vulnerability Affected: All versions, or not specified
CVE-2018-15403	5.4	1%	Oct 5	A vulnerability in the web interface of Cisco Emergency Responder, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, and Cisco… Affected: 10.5(2.10000.5); 11.0(1.10000.10); 11.5(1.10000.6); 12.0(1.10000.10)
CVE-2018-0340	5.4	1%	Jun 7	A vulnerability in the web framework of the Cisco Unified Communications Manager (Unified CM) software could allow an authenticated, remote attacker to conduct a cross-site… Affected: 10.5(2.10000.5); 11.0(1.10000.10); 11.5(1.10000.6); 12.0(1.10000.10)
CVE-2017-12357	5.4	1%	Nov 30	A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS)… Affected: 10.5(2.10000.5); 11.0(1.10000.10); 11.5(1.10000.6); 12.0(1.10000.10)
CVE-2017-3888	5.4	1%	Apr 7	A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct a reflected cross-site… Affected: 12.0(0.98000.452)
CVE-2017-3874	5.4	1%	Mar 17	A vulnerability in the web framework of Cisco Unified Communications Manager (CallManager) could allow an authenticated, remote attacker to perform a cross-site scripting (XSS)… Affected: 11.5(1.11007.2)
CVE-2022-20752	5.3	1%	Jul 6	A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection… Affected: 12.5\(1\) before 12.5\(1\)su6; 12.5\(1\) before 12.5\(1\)su6; 14.0 before 14su1; 14.0 before 14su1
CVE-2018-0198	5.3	2%	Mar 27	A vulnerability in the web framework of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to view sensitive data Affected: All versions, or not specified
CVE-2018-0105	5.3	2%	Jan 18	A vulnerability in the web framework of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to view sensitive data Affected: All versions, or not specified
CVE-2021-1406	4.9	1%	Apr 8	A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an… Affected: 10.5(2); 10.5(2); 10.5(2)su1; 10.5(2)su1; 10.5(2)su2; 10.5(2)su2; +34 more
CVE-2021-1364	4.9	1%	Jan 20	Multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an attacker to conduct path traversal attacks and SQL… Affected: before 11.5\(1\)su9; before 11.5\(1\)su9; 12.0 before 12.0\(1\)su4; 12.0 before 12.0\(1\)su4; 12.5 before 12.5\(1\)su4; 12.5 before 12.5\(1\)su4
CVE-2021-1282	4.9	1%	Jan 20	Multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an attacker to conduct path traversal attacks and SQL… Affected: before 11.5\(1\)su9; before 11.5\(1\)su9; 12.0 before 12.0\(1\)su4; 12.0 before 12.0\(1\)su4; 12.5 before 12.5\(1\)su4; 12.5 before 12.5\(1\)su4
CVE-2019-12710	4.9	1%	Oct 2	A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an… Affected: 10.5(2.10000.5); 11.5(1.10000.6); 12.0(1.10000.10); 12.5(1.10000.22)
CVE-2017-3886	4.9	2%	Apr 7	A vulnerability in the Cisco Unified Communications Manager web interface could allow an authenticated, remote attacker to impact the confidentiality of the system by executing… Affected: 11.0(1.10000.10); 11.5(1.10000.6)
CVE-2022-20862	4.3	1%	Jul 6	A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition… Affected: before 12.5\(1\)su6; before 12.5\(1\)su6; 14.0 before 14su2; 14.0 before 14su2
CVE-2021-34701	4.3	2%	Nov 4	A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition… Affected: before 14su1; before 14su1
CVE-2021-1399	4.3	1%	Apr 8	A vulnerability in the Self Care Portal of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME)… Affected: 10.5\(2\) before 12.5\(1\)su4; 10.5\(2\) before 12.5\(1\)su4
CVE-2018-0266	4.3	2%	Apr 19	A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view sensitive data Affected: 10.5(2.10000.5); 11.0(1.10000.10); 11.5(1.10000.6); 12.0(1.10000.10)
CVE-2018-0135	4.3	1%	Feb 8	A vulnerability in Cisco Unified Communications Manager could allow an authenticated, remote attacker to access sensitive information on an affected system Affected: 11.0(1.24075.1)
CVE-2018-0120	4.3	1%	Feb 8	A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct an SQL injection attack against an affected… Affected: 11.5(1.13900.52)
CVE-2017-6785	4.3	2%	Aug 17	A vulnerability in configuration modification permissions validation for Cisco Unified Communications Manager could allow an authenticated, remote attacker to perform a horizontal… Affected: 10.5(2.10000.5); 11.0(1.10000.10); 11.5(1.10000.6)
CVE-2017-3836	4.3	2%	Feb 22	A vulnerability in the web framework Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to view sensitive data Affected: 11.5(1.11007.2)