Cisco Unity Connection Flaws Enable Full System Takeover

Cisco published a high-priority advisory for two independent vulnerabilities in Cisco Unity Connection: CVE-2026-20034, an authenticated remote code execution in the web management interface that can lead to arbitrary code execution as root, and CVE-2026-20035, an unauthenticated Server-Side Request Forgery in the Web Inbox feature that can be abused to send network requests from the affected device and probe internal networks; Cisco recommends applying the listed fixed releases or specific patches immediately as there are no effective workarounds.