Cisco UIC and CCX Exposed to Blind SQL Injection via Web Interface

Cisco Unified Intelligence Center suffers from a blind SQL injection vulnerability within its web-based management interface. This flaw allows an attacker who has already obtained valid user credentials to manipulate database queries. Cisco PSIRT published advisory cisco-sa-cuic-sql-inject-2qbfWSm5 regarding this issue, assigning it CVE-2026-20327. The base CVSS score is 6.5, classifying the risk as medium.

Root cause

The vulnerability stems from insufficient validation of user-supplied input. The application fails to properly sanitise data entered through the web interface before processing it. This lack of validation enables an attacker to inject malicious SQL commands. Hesham Ahmed from Spark Professional Services reported the flaw to Cisco, leading to the publication of this advisory.

Attack path

An attacker must first possess valid credentials for the affected device. Once authenticated, they send a crafted request to the web-based management interface. This request triggers the blind SQL injection attack. A successful exploit allows the attacker to read the contents of the internal database. Cisco PSIRT stated that no public announcements or malicious use of this vulnerability were known at the time of publication.

Affected versions

• Cisco Unified Intelligence Center is affected regardless of device configuration.
• Cisco Unified Contact Center Express is affected because it includes the vulnerable UIC software bundle.
• Specific release details are available in the fixed software section of the advisory.

Mitigation

• Upgrade to the fixed software releases indicated in the Cisco advisory.
• Verify that all UIC and CCX instances are patched promptly.
• There are no workarounds that address this vulnerability.
• Monitor for future updates regarding this bug ID CSCwt51262.

Signals worth monitoring

Teams usually inspect web server logs for anomalous request patterns from authenticated accounts. Look for unusual query parameters or unexpected response times that might indicate blind injection attempts. Check whether database access logs show queries initiated by service accounts that rarely interact with the management interface. Review alert thresholds for excessive data retrieval from the internal database. Containment moves typically involve restricting access to the web interface and auditing active sessions.

Background: CVSS score

A CVE is a unique identifier for a specific security flaw, acting like a name tag. A CVSS score is a numerical rating of that flaw’s severity. You use the CVE to find the issue and the CVSS score to decide how urgently you must fix it. They serve different functions in your workflow.

Read the full guide: Difference Between CVE and CVSS Score: How to Priorise Remediation

What to do and how to stay safe: Cisco

• Inventory all Cisco Unified Intelligence Center and CCX deployments in your environment.
• Check current software versions against the vulnerability table in the advisory.
• Apply the available updates to remediate the SQL injection flaw.
• Monitor for any unauthorised database access attempts from authenticated users.

Step-by-step guide: Out-of-band patches: what small businesses need to know

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is this vulnerability being exploited in the wild?

Cisco PSIRT stated that it was not aware of any malicious use or public announcements regarding this vulnerability at the time of publication.

Does this affect Cisco Unified Contact Center Express?

Yes, Cisco Unified Contact Center Express is affected because it includes Cisco Unified Intelligence Center as part of its software bundle.

Are there any workarounds for this SQL injection flaw?

No, Cisco stated that there are no workarounds that address this vulnerability; upgrading to fixed software is the only remediation.