CVE-2011-3288: Cisco Unified Presence before 8.5(4) does not properly detect recursion during entity expansion, which allo...

Security readout for executives and security teams

CVE-2011-3288 is a denial-of-service flaw in Cisco Unified Presence before 8.5(4). A remote attacker could send malformed XML that exhausts CPU and memory or crashes a process, disrupting presence and communications services. The sources do not show data theft, privilege escalation, or confirmed active exploitation. Exposure is most likely in organizations still running Cisco Unified Presence versions earlier than 8.5(4), especially where XML-processing service interfaces are reachable by untrusted users or networks. The provided source bundle does not identify exact ports, deployment prerequisites, or all affected Cisco products. Prioritize remediation for internet-facing or broadly reachable presence systems because exploitation could disrupt communications availability. For isolated or retired deployments, urgency is lower but still requires inventory closure because the affected software is old. Mitigation focus: Inventory Cisco Unified Presence deployments and record exact software versions.; Upgrade systems earlier than 8.5(4) to 8.5(4) or vendor-supported fixed releases.; Review the Cisco advisory for product-specific remediation or workaround guidance..

Prepared

Jun 27, 2026, 17:48 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.