Cisco Unity Connection Web Inbox SSRF Vulnerability (CVE-2026-20035)

The National Vulnerability Database has disclosed CVE-2026-20035, a high-severity Server-Side Request Forgery (SSRF) vulnerability in the web UI of Cisco Unity Connection Web Inbox. This flaw, rated 7.2 CVSSv3.1, stems from improper input validation for specific HTTP requests.

An unauthenticated, remote attacker can exploit this by sending a crafted HTTP request. The successful exploitation allows the attacker to force the affected device to send arbitrary network requests, effectively turning the Cisco Unity Connection Web Inbox into a proxy for malicious activity. This significantly expands an attacker’s reach within a network, potentially bypassing perimeter defenses and accessing internal resources.

While specific affected products are not detailed by the National Vulnerability Database, organizations utilizing Cisco Unity Connection Web Inbox should consider this a critical alert. The ability for an unauthenticated attacker to initiate arbitrary network requests from a trusted internal device creates a dangerous pivot point for reconnaissance, lateral movement, and data exfiltration.