Unified Communications Manager vulnerabilities | LiveThreat CVE Feed

Product

Unified Communications Manager

by Cisco · last CVE Jun 3, 2026

On CISA KEVExploited in the wild

238

CVEs

On KEV

10.0

Max CVSS

New 30D

Vulnerabilities238 In the news7 Timeline

Severity mix

Critical 4High 24Medium 75Low 0

Severity

All severities238 Critical4 High24 Medium75 Low0

Exploitation

On CISA KEV2 Exploited in the wild2

Watch

Add Unified Communications Manager to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2022-20787	6.8	0%	Apr 21	A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) Software and Cisco Unified CM Session Management Edition (SME) Software… Affected: 12.5\(1\) before 12.5\(1\)su6; 12.5\(1\) before 12.5\(1\)su6; 14.0 before 14su1; 14.0 before 14su1
CVE-2025-20278	6.7	0%	Jun 4	Cisco Unified Communications Products Command Injection Vulnerability Affected: 12.5(1); 12.5(1)su1; 12.5(1)su2; 12.5(1)su3; 12.5(1)su4; 12.5(1)su5; +6 more
CVE-2022-20791	6.5	2%	Jul 6	A vulnerability in the database user privileges of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM… Affected: through 11.5\(1.10000.6\); through 11.5\(1.10000.6\); 12.5 through 12.5\(1.10000.22\); 12.5 through 12.5\(1.10000.22\); 14.0 through 14.0\(1.10000.20\); 14.0 through 14.0\(1.10000.20\)
CVE-2022-20804	6.5	0%	Apr 21	A vulnerability in the Cisco Discovery Protocol of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified… Affected: through 14.0; through 14.0
CVE-2022-20790	6.5	2%	Apr 21	A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition… Affected: through 14.0; through 14.0
CVE-2022-20789	6.5	1%	Apr 21	A vulnerability in the software upgrade process of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified… Affected: 12.5(1); 12.5(1); 14.0; 14.0
CVE-2021-34773	6.5	1%	Nov 4	A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition… Affected: 14.0(1.10000.20)
CVE-2021-1478	6.5	1%	May 6	A vulnerability in the Java Management Extensions (JMX) component of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management… Affected: before 12.6; before 12.6
CVE-2021-1357	6.5	1%	Jan 20	Multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an attacker to conduct path traversal attacks and SQL… Affected: before 11.5\(1\)su9; before 11.5\(1\)su9; 12.0 before 12.0\(1\)su4; 12.0 before 12.0\(1\)su4; 12.5 before 12.5\(1\)su4; 12.5 before 12.5\(1\)su4
CVE-2021-1355	6.5	1%	Jan 20	Multiple vulnerabilities in Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an attacker to conduct path traversal attacks and SQL… Affected: before 11.5\(1\)su9; before 11.5\(1\)su9; 12.0 before 12.0\(1\)su4; 12.0 before 12.0\(1\)su4; 12.5 before 12.5\(1\)su4; 12.5 before 12.5\(1\)su4
CVE-2021-1226	6.5	1%	Jan 13	A vulnerability in the audit logging component of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified… Affected: 11.5\(1\) before 11.5\(1\)su9; 11.5\(1\) before 11.5\(1\)su9; 10.5(2); 10.5(2)
CVE-2019-15963	6.5	1%	Sep 23	A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view sensitive information in the… Affected: 10.5 through 10.5\(2.10000.5\); 11.5 through 11.5\(1.10000.6\); 12.0 through 12.0\(1.10000.10\); 12.5 through 12.5\(1.10000.22\)
CVE-2019-1915	6.5	1%	Oct 2	A vulnerability in the web-based interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition (SME), Cisco Unified… Affected: 10.5(2.10000.5); 11.5(1.10000.6); 12.0(1.10000.10); 12.5(1.10000.22)
CVE-2019-15272	6.5	1%	Oct 2	A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an… Affected: 10.5(2.10000.5); 11.5(1.10000.6); 12.0(1.10000.10); 12.5(1.10000.22)
CVE-2019-12711	6.5	1%	Oct 2	A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an… Affected: 10.5(2.10000.5); 11.5(1.10000.6); 12.0(1.10000.10); 12.5(1.10000.22)
CVE-2018-0267	6.5	0%	Apr 19	A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, local attacker to view sensitive data that should be restricted Affected: 10.5(2.10000.5); 11.0(1.10000.10); 11.5(1.10000.6); 12.0(1.10000.10)
CVE-2017-6758	6.5	4%	Aug 7	A vulnerability in the web framework of Cisco Unified Communications Manager 11.5(1.10000.6) could allow an authenticated, remote attacker to access arbitrary files in the context… Affected: 11.5(1.10000.6)
CVE-2017-3877	6.5	1%	Mar 17	A vulnerability in the web framework of Cisco Unified Communications Manager (CallManager) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery… Affected: 11.5(1.11.007.2)
CVE-2016-6440	6.5	1%	Oct 27	The Cisco Unified Communications Manager (CUCM) may be vulnerable to data that can be displayed inside an iframe within a web page, which in turn could lead to a clickjacking… Affected: 11.5(0.99838.4)
CVE-2015-6433	6.5	1%	Jan 8	SQL injection vulnerability in Cisco Unified Communications Manager 11.0(0.98000.225) allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka… Affected: 11.0(0.98000.225)
CVE-2024-20511	6.1	0%	Nov 6	Cisco Unified Communications Manager Cross-Site Scripting Vulnerability Affected: 12.0(1)su1; 12.0(1)su2; 12.0(1)su3; 12.0(1)su4; 12.0(1)su5; 12.5(1); +11 more
CVE-2024-20488	6.1	0%	Aug 21	Cisco Unified Communications Manager Cross-Site Scripting Vulnerability Affected: 12.5(1); 12.5(1)su1; 12.5(1)su2; 12.5(1)su3; 12.5(1)su4; 12.5(1)su5; +15 more
CVE-2023-20242	6.1	0%	Aug 16	A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified CM Session Management Edition (Unified CM SME), and Cisco… Affected: 11.5(1); 11.5(1); 12.5(1); 12.5(1); 14.0; 14.0
CVE-2022-20815	6.1	1%	Jul 6	A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified CM Session Management Edition (Unified CM SME), and Cisco… Affected: 14.0 before 14su2; 14.0 before 14su2
CVE-2022-20800	6.1	1%	Jul 6	A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition… Affected: 11.5\(1\) before 14su2; 11.5\(1\) before 14su2
CVE-2022-20788	6.1	1%	Apr 21	A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified CM Session Management Edition (Unified CM SME), and Cisco… Affected: 11.5\(1\) before 11.5\(1\)su11; 11.5\(1\) before 11.5\(1\)su11; 12.5\(1\) before 12.5\(1\)su6; 12.5\(1\) before 12.5\(1\)su6; 14.0 before 14su1; 14.0 before 14su1
CVE-2021-1409	6.1	1%	Apr 8	Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service… Affected: before 14; before 14
CVE-2021-1408	6.1	1%	Apr 8	Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service… Affected: before 14; before 14
CVE-2021-1407	6.1	1%	Apr 8	Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service… Affected: before 14; before 14
CVE-2021-1380	6.1	1%	Apr 8	Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service… Affected: before 14; before 14
CVE-2020-3346	6.1	1%	Aug 17	A vulnerability in the web UI of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow… Affected: 10.5\(2\) through 10.5\(2\)su10; 10.5\(2\) through 10.5\(2\)su10; 11.5\(1\) through 11.5\(1\)su8; 11.5\(1\) through 11.5\(1\)su8; 12.0(1); 12.0(1); +2 more
CVE-2020-3282	6.1	1%	Jul 2	A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified… Affected: 10.5\(2\) before 10.5\(2\)su10; 10.5\(2\) before 10.5\(2\)su10; 11.5\(1\) before 11.5\(1\)su8; 11.5\(1\) before 11.5\(1\)su8; 12.0(1); 12.0(1); +2 more
CVE-2015-0749	6.1	1%	Feb 19	A vulnerability in Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on the affected software Affected: through 10.5\(2.10000.5\)
CVE-2019-12716	6.1	1%	Oct 2	A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an… Affected: 10.5(2.10000.5); 11.5(1.10000.6); 12.0(1.10000.10); 12.5(1.10000.22)
CVE-2019-12715	6.1	1%	Oct 2	A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) could allow an… Affected: 10.5(2.10000.5); 11.5(1.10000.6); 12.0(1.10000.10); 12.5(1.10000.22)
CVE-2019-12707	6.1	1%	Oct 2	A vulnerability in the web-based interface of multiple Cisco Unified Communications products could allow an unauthenticated, remote attacker to conduct a cross-site scripting… Affected: 10.5(2.10000.5); 11.5(1.10000.6); 12.0(1.10000.10); 12.5(1.10000.22)
CVE-2018-0411	6.1	2%	Aug 1	A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a reflected cross-site… Affected: 10.5(2.10000.5); 11.0(1.10000.10); 11.5(1.10000.6); 12.0(1.10000.10)
CVE-2018-0355	6.1	2%	Jun 7	A vulnerability in the web UI of Cisco Unified Communications Manager (Unified CM) could allow an unauthenticated, remote attacker to conduct a cross-frame scripting (XFS) attack… Affected: 10.5(2.10000.5); 11.0(1.10000.10); 11.5(1.10000.6); 12.0(1.10000.10)
CVE-2018-0328	6.1	2%	May 17	A vulnerability in the web framework of Cisco Unified Communications Manager and Cisco Unified Presence could allow an unauthenticated, remote attacker to conduct a cross-site… Affected: 10.5(2.10000.5); 11.0(1.10000.10); 11.5(1.10000.6); 12.0(1.10000.10)
CVE-2018-0206	6.1	1%	Feb 22	A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a reflected cross-site… Affected: 11.5(1.13900.52)
CVE-2018-0118	6.1	2%	Jan 11	A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to perform a cross-site scripting… Affected: All versions, or not specified
CVE-2017-12258	6.1	2%	Oct 5	A vulnerability in the web-based UI of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to execute a cross-frame scripting (XFS) attack Affected: All versions, or not specified
CVE-2017-6654	6.1	2%	May 22	A vulnerability in the web-based management interface of Cisco Unified Communications Manager 10.5 through 11.5 could allow an unauthenticated, remote attacker to conduct a… Affected: 10.5(2.10000.5); 11.0(1.10000.10); 11.5(1.10000.6)
CVE-2017-3872	6.1	1%	Mar 17	A cross-site scripting (XSS) filter bypass vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote… Affected: 10.5(2.10000.5); 10.5(2.14076.1); 11.0(1.10000.10); 11.5(1.10000.6)
CVE-2017-3833	6.1	1%	Feb 22	A vulnerability in the web framework of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against… Affected: 12.0(0.99999.2)
CVE-2017-3829	6.1	2%	Feb 22	A vulnerability in the web-based management interface of Cisco Unified Communications Manager Switches could allow an unauthenticated, remote attacker to conduct a cross-site… Affected: 11.0(1.10000.10); 11.5(1.10000.6)
CVE-2017-3828	6.1	2%	Feb 22	A vulnerability in the web-based management interface of Cisco Unified Communications Manager Switches could allow an unauthenticated, remote attacker to conduct a cross-site… Affected: 11.0(1.10000.10); 11.5(1.10000.6)
CVE-2017-3821	6.1	2%	Feb 22	A vulnerability in the serviceability page of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct reflected cross-site scripting (XSS)… Affected: 10.5(2.14076.1)
CVE-2017-3802	6.1	1%	Jan 26	A vulnerability in Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web… Affected: 12.0(0.99000.9)
CVE-2017-3798	6.1	1%	Jan 26	A cross-site scripting (XSS) filter bypass vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote… Affected: 11.5(1.12000.1)