CVE-2026-20230Cisco Unified Communications Manager Server-Side Request Forgery (SSRF)
Vulnerability Summary
This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root.
Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.
Note: To exploit this vulnerability, the WebDialer service must be enabled. WebDialer is disabled by default.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:NAffected & Patched Versions
- Cisco Unified Communications Manager >= 14.0 and < 14su6
- Cisco Unified Communications Manager >= 15.0 and <= 15su4a
- Cisco Unified Communications Manager 14su6
What to do
Patch now. CISA lists this flaw as exploited in the wild and set a federal remediation deadline of Jun 28, 2026.
- Check whether you run Cisco Unified Communications Manager and which version.
- Update to a patched version listed above, then confirm the new version.
- Review logs and exposed services for signs of earlier compromise.
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA KEV Status
Remediation due: Jun 28, 2026 (deadline passed)
Timeline
- Jun 3, 2026Published
- Jun 25, 2026Added to CISA KEV catalog
- Jun 28, 2026KEV remediation due date
- Oct 7, 2026Record last modified
Score, severity and exploitation changes are tracked from the day Watchtower started logging them.
Related Coverage
- CVE-2026-76461 (CVSS 9.8): Cisco Email Root RCE Exploited
- Cisco Unified CM RCE Flaw Exploited in the Wild as PoC Code Goes Public
- Weekly CVE Report Logs 1,909 New Vulnerabilities and 6 Exploited Flaws
- CISA Adds Cisco Unified CM and PTC Windchill Flaws to KEV Catalog
- Cisco Unified CM Vulnerability Exposed with Public Exploit Code
More Cisco Unified Communications Manager CVEs
External References
Data last checked: Nov 14, 2026 07:11 UTC