Cisco Unified Intelligence Center SQL Injection Vulnerability

Description

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to read the contents of the internal database of an affected device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cuic-sql-inject-2qbfWSm5 Security Impact Rating: Medium CVE: CVE-2026-20327

What to do

Install the fixed versions listed in the official advisory. If you cannot update right away, apply the workarounds or mitigations it describes and limit access to the affected service.

Details

Vendor

Cisco

Product

Cisco Unified Intelligence Center

CVE

CVE-2026-20327

Affected versions

Cisco Unified Intelligence Center 11.6: 11.6(1)
Cisco Unified Intelligence Center 10.5: 10.5(1)
Cisco Unified Intelligence Center 11.0: 11.0(1); 11.0(2); 11.0(3)
Cisco Unified Intelligence Center 11.5: 11.5(1)
Cisco Unified Intelligence Center 12.0: 12.0(1)
Cisco Unified Intelligence Center 12.5: 12.5(1); 12.5(1)SU; 12.5(2)ET_CSCwi79933
Cisco Unified Intelligence Center 12.6: 16 versions, from 12.6(1) to 12.6.2_CSCwp92614_ET
Cisco Unified Intelligence Center 15.0: 9 versions, from 15.0(1) to 15.0.1_CSCwu75294_ET (from the advisory and NVD; check the exact builds in the official advisory)

CVSS score

6.5

Actively exploited

Not known at this time

Source

Cisco PSIRT – original advisory

Published

October 20, 2026

The description and the recommended action are quoted from the public advisory (the action is our generic advice); severity, exploitation status and affected versions are compiled automatically from public sources and may contain errors. The vendor's original advisory prevails: check it before taking action. This information is provided without warranty and does not replace a professional assessment.