Loading story…
Cisco released fixes for a critical remote code execution vulnerability in Unified Communications and Webex Calling Dedicated Instance, tracked as CVE-2026-20045, after it was actively exploited as a zero-day. The issue stems from improper validation of user-supplied input in HTTP requests to the web-based management interface; successful exploitation can provide user-level OS access and enable privilege escalation to root. Affected products include Cisco Unified Communications Manager (Unified CM), Unified CM Session Management Edition (SME), Unified CM IM & Presence, Cisco Unity Connection, and Webex Calling Dedicated Instance; Cisco provided version-specific remediations including fixed releases and .cop patch files (e.g., ciscocm.V14SU4a_CSCwr21851_remote_code_v1.cop.sha512).
CISA added CVE-2026-20045 to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation and highlighting code injection flaws as a common attack vector with significant risk to the federal enterprise. Under Binding Operational Directive (BOD) 22-01, Federal Civilian Executive Branch agencies are required to remediate KEV-listed vulnerabilities by the specified due date, and CISA urged all organizations to similarly prioritize patching to reduce exposure to ongoing attacks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
CISA added CVE-2026-20045 to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. The agency set a remediation deadline of 2026-02-11 for Federal Civilian Executive Branch agencies under Binding Operational Directive 22-01.
Alongside the advisory, Cisco PSIRT said it had observed exploitation attempts against CVE-2026-20045 in the wild, making the issue a zero-day at disclosure. Reports noted the company did not provide attribution or scope details for the attacks.
Cisco released security fixes for CVE-2026-20045, a critical code injection/remote code execution flaw in multiple Unified Communications products and Webex Calling Dedicated Instance. Cisco said the bug affects the web-based management interface, has no workaround, and can allow unauthenticated attackers to gain OS access and potentially escalate to root.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesec.cloudapps.cisco.com
Open sourcedarkreading.com
Open sourcego.theregister.com
Open sourcesecurityonline.info
Open sourcethecyberthrone.in
Open sourcebleepingcomputer.com
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reports warn of **in-the-wild exploitation** of critical remote code execution vulnerabilities affecting widely deployed enterprise infrastructure. One report describes a purported Cisco Unified Communications zero-day, **CVE-2024-20253**, impacting *Cisco Unified Communications Manager (Unified CM)*, *Cisco Unity Connection*, and *Webex Calling Dedicated Instance*, and claims it enables **unauthenticated command execution** via the web management interface, creating risk of full system compromise and rapid opportunistic scanning of internet-exposed instances. Separately, **CISA added Broadcom VMware vCenter Server CVE-2024-37079** (CVSS 9.8) to the **Known Exploited Vulnerabilities (KEV)** catalog based on evidence of exploitation; the issue is described as a **DCE/RPC heap overflow** that can lead to RCE via specially crafted network packets, and Broadcom updated its advisory to acknowledge observed exploitation. A third item (Rapid7’s Metasploit wrap-up) is not about either of these active-exploitation advisories; it covers new Metasploit modules for unrelated vulnerabilities (e.g., Oracle E-Business Suite **CVE-2025-61882** and Splunk issues), which may increase general exploitation capability but does not substantively corroborate the Cisco or VMware events.
Jun 29, 2026
Attackers are actively exploiting **CVE-2026-20230**, a critical flaw in Cisco Unified Communications Manager (**Unified CM**) and Unified CM Session Management Edition (**Unified CM SME**), shortly after technical details and proof-of-concept code became public. Cisco said the bug stems from improper input validation in certain HTTP requests and can let an unauthenticated attacker perform **SSRF**, write arbitrary files to the underlying operating system, and potentially escalate privileges to **root**; researchers also described a path to unauthenticated remote code execution. Exploitation requires the **WebDialer** service to be enabled, although Cisco notes it is disabled by default. Exploit intelligence firm Defused reported seeing attacks from a single source using an unvetted PoC, with `file://` file-write payloads observed against decoy systems over the weekend. Cisco patched the issue in **Unified CM 14SU6** and **15SU5**, while SSD Secure Disclosure, which reported the vulnerability, published additional technical details showing how attackers could recover a target's true hostname and progress toward code execution. Cisco has advised customers to apply the fixes and, if patching cannot be done immediately, disable **WebDialer** to reduce exposure on widely deployed enterprise voice platforms.
Jul 2, 2026
Cisco released emergency fixes for two **critical (CVSS 10.0)** vulnerabilities in its firewall management software that could allow **remote, unauthenticated attackers** to execute code and gain **root-level** access to the underlying operating system. The issues are tracked as `CVE-2026-20079` and `CVE-2026-20131`, and reporting emphasized the risk profile given Cisco’s widespread deployment in large enterprises and the historical interest of sophisticated actors in rapidly weaponizing Cisco bugs. Available reporting stated there were **no confirmed in-the-wild exploitation** reports at the time of publication, but urged rapid patching due to the combination of unauthenticated reachability and full compromise potential. Separate coverage packaged the Cisco flaws alongside other weekly security items (e.g., Tycoon2FA infrastructure takedown and other incidents), but the Cisco item consistently described the same two maximum-severity firewall management vulnerabilities and their impact (RCE leading to root access).
Jun 29, 2026