Cisco Unified Communications Products Security Hardening Release: October 2026
cisco-sa-voice-hardening-twgbH9e3
Summary
A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to read the contents of the internal database of an affected device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Products covered
A separate affected-products list was not included in the collected bulletin.
Remediation
There are no workarounds that address this vulnerability.
Cisco considers any workarounds and mitigations (if applicable) to be temporary solutions until an upgrade to a fixed software release is available. To remediate this vulnerability and avoid future exposure as described in this advisory, Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory.
Fixed Releases
At the time of publication, the release information in the following table was accurate. See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information.
The left column lists Cisco software releases, and the right column indicates whether a release was affected by the vulnerability that is described in this advisory and which release included the fix for this vulnerability.
Cisco Unified Intelligence Center Software Release | First Fixed Release |
|---|---|
Earlier than 12.6 | Migrate to a fixed release. |
12.6 | 12.6(2) ES08 |
15.0 | 15.0(1) SU2 |
Cisco Unified CCX Software Release | First Fixed Release |
|---|---|
Earlier than 15.0 | Migrate to a fixed release. |
15.0 | 15.0(1) SU1 |
The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory.
CVEs in this advisory 1
Update history
What changed in later vendor updates
SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.
- The vendor changed the advisory summary.
Updates
- Added to SecurityAlert
We collected the advisory from the official source.
- Published by Cisco
The publication date reported by the vendor.
- Confirmed at the source
Our collector saw this advisory during a later source check.