Cisco Unified CM Flaw CVE-2026
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-20230 | SSRF in Cisco Unified Communications Manager Enables Root Escalation An unauthenticated server-side request forgery (SSRF) flaw exists in Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (Unified CM SME), caused by improper input validation of specific HTTP requests. An attacker triggers it by sending a crafted HTTP request to the device's WebDialer service, which must be enabled for exploitation (it is disabled by default). Successful exploitation lets the attacker write files to the underlying operating system, which can later be used to elevate privileges to root — the reason Cisco assigned a Critical Security Impact Rating despite the 8.6 (High) CVSS base score. Organizations running affected Unified CM or Unified CM SME deployments, particularly those with WebDialer enabled and reachable from untrusted networks, are exposed. The flaw is being exploited in the wild: public exploit references appeared in mid-June 2026, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-06-25, with EPSS indicating an ~88% probability of exploitation within 30 days. Do: Upgrade affected Unified CM and Unified CM SME deployments to the fixed release cited in Cisco's advisory (specific version not provided in this dataset), prioritizing internet-exposed systems per CISA BOD 26-04 requirements. Confirm whether the WebDialer service is enabled and disable it if unused, or restrict network access to it. Check device logs for crafted HTTP requests hitting WebDialer endpoints and unexpected file writes on the underlying OS that could indicate prior exploitation. | 8.6 | 88% | KEV PoC |
| largetens of thousands of internet-exposed Unified CM/SME systems, with the directly exploitable subset smaller because WebDialer must be enabled |
Full article478 words · extracted from securityaffairs.com · click to collapse
Attackers exploit Cisco Unified CM flaw (CVE-2026-20230) allowing unauth HTTP requests to trigger SSRF, write files, and gain root access
Cisco Unified Communications Manager has a serious vulnerability, tracked as CVE-2026-20230 (CVSS score of 8.6), that attackers are already exploiting. The flaw, caused by improper validation of certain HTTP requests, allows a remote attacker without authentication to perform server-side request forgery (SSRF) attacks. Early June, Cisco warned that public PoC code is available and that successful exploitation could allow attackers to write files that may later be used to gain root privileges.
This makes affected systems high risk if exposed. Be careful.
“This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device.” reads the advisory. “A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root.”
Cisco rated this advisory as Critical instead of High because successful exploitation could allow an attacker to escalate privileges to root. However, the risk depends on configuration: the vulnerability can only be exploited if the WebDialer service is enabled, which is disabled by default on affected systems.
There is no full workaround for this vulnerability. The networking giant recommends mitigating risk by disabling the WebDialer service until a patch is applied. Administrators can do this through the Unified CM Administration interface by going to Unified Serviceability, opening Service Activation under Tools, and unchecking the WebDialer Web Service option in the CTI Services section before saving the changes.
Below are the fixed releases:
| Cisco Unified CM and Unified CM SME Release | First Fixed Release |
|---|---|
| 14 | 14SU6 |
| 15 | 15SU5 (Sep 2026) or COP1 |
The company confirms that PoC exploit code for the vulnerability is publicly available. However, the PSIRT is not aware of attacks in the wild exploiting this issue.
This week, Defused Cyber researchers confirmed it observed active exploitation of the issue in attacks in the wild.
— Defused (@DefusedCyber) June 22, 2026🚨 Over the weekend we observed exploitation of CVE-2026-20230 – Cisco Unified CM (CUCM) WebDialer SSRF → root file-write (CVSS 8.6)
No previously recorded exploitation, and not yet listed in CISA KEV.
This is currently being exploited from a single source using an unvetted… pic.twitter.com/VBgJF8zJfj
“Over the weekend we observed exploitation of CVE-2026-20230 – Cisco Unified CM (CUCM) WebDialer SSRF → root file-write (CVSS 8.6)” the researchers wrote on X. “No previously recorded exploitation, and not yet listed in CISA KEV.
This is currently being exploited from a single source using an unvetted PoC, with genuinely-formatted file:// file-write payloads landing on our decoys. Track Cisco CUCM exploitation”
At this time, Cisco PSIRT has yet to confirm active exploitation of the flaw.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CVE-2026-20230)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/194153/hacking/cisco-unified-cm-flaw-cve-2026-20230-actively-exploited-in-the-wild.html