CVE-2026-20327

Cisco Unified Intelligence Center contains a blind SQL injection flaw (CWE-89) in its web-based management interface, caused by insufficient validation of user-supplied input. To trigger it, an attacker who already holds valid user credentials on the affected device sends a crafted request to the management interface. A successful exploit lets the attacker read the contents of the device's internal database, with no impact on integrity or availability. Any organization running Cisco Unified Intelligence Center is exposed, though the requirement for valid, low-privileged credentials raises the bar for exploitation. As of publication there is no known exploitation, no public proof-of-concept, the flaw is not in the CISA KEV catalog, and EPSS puts the 30-day exploitation probability at roughly 0.2%.

What to do: Check whether Cisco Unified Intelligence Center is deployed in your environment and apply the fix released with Cisco's August 19, 2026 advisories, consulting the official advisory for the affected and fixed release lists. Until patched, restrict access to the web-based management interface to trusted management networks and limit which accounts hold valid credentials on the device. Monitor authentication logs for low-privileged accounts querying the management interface, since exploitation requires valid credentials.