CVE-2016-9206: A vulnerability in the ccmadmin page of Cisco Unified Communications Manager (CUCM) could allow an unauthen...

Security readout for executives and security teams

This issue affects Cisco Unified Communications Manager admin pages. An outside attacker could trigger reflected cross-site scripting in the ccmadmin page, potentially abusing a user’s browser session. The source bundle does not provide CVSS scoring or evidence of active exploitation. Exposure is most likely where affected CUCM 11.5 builds are deployed and the ccmadmin interface is reachable by untrusted users or networks. Internet exposure would increase urgency, but the bundle does not state exposure prevalence. Treat this as a maintenance-priority security fix unless ccmadmin is exposed beyond trusted administrators. If exposed, raise priority because CUCM is operationally important communications infrastructure. Mitigation focus: Upgrade affected CUCM systems to a Cisco-listed fixed release.; Review Cisco advisory cisco-sa-20161207-cucm and bug CSCvb64641 guidance.; Restrict ccmadmin access to trusted administrative networks..

Prepared

Jun 13, 2026, 13:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.