Loading story…
Attackers are actively exploiting CVE-2026-20230, a critical flaw in Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (Unified CM SME), shortly after technical details and proof-of-concept code became public. Cisco said the bug stems from improper input validation in certain HTTP requests and can let an unauthenticated attacker perform SSRF, write arbitrary files to the underlying operating system, and potentially escalate privileges to root; researchers also described a path to unauthenticated remote code execution. Exploitation requires the WebDialer service to be enabled, although Cisco notes it is disabled by default.
Exploit intelligence firm Defused reported seeing attacks from a single source using an unvetted PoC, with file:// file-write payloads observed against decoy systems over the weekend. Cisco patched the issue in Unified CM 14SU6 and 15SU5, while SSD Secure Disclosure, which reported the vulnerability, published additional technical details showing how attackers could recover a target's true hostname and progress toward code execution. Cisco has advised customers to apply the fixes and, if patching cannot be done immediately, disable WebDialer to reduce exposure on widely deployed enterprise voice platforms.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Cisco publicly confirmed that attackers are actively exploiting CVE-2026-20230 in Unified CM. The company urged customers to upgrade to fixed releases or disable the vulnerable WebDialer service as a mitigation.
On 2026-06-25, CISA added CVE-2026-20230 to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. CISA set a remediation deadline of 2026-06-28 for federal agencies and urged urgent patching, forensic triage, and exposure assessment.
Over the weekend, Defused reported seeing active exploitation from a single source using an unvetted proof-of-concept. Its decoy systems were hit with file-write payloads targeting the flaw.
Shortly after Cisco's patch, SSD Secure Disclosure published technical details and proof-of-concept code for the vulnerability. The material showed the issue could be leveraged for unauthenticated remote code execution, including obtaining the target's true hostname and enabling a path toward code execution.
On 2026-06-03, Cisco disclosed and patched CVE-2026-20230, a critical vulnerability in Unified Communications Manager and Unified CM SME. Cisco said the flaw could allow unauthenticated SSRF, arbitrary file writes to the underlying operating system, and potential privilege escalation to root when WebDialer is enabled.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
13 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcebleepingcomputer.com
Open sourcecysecurity.news
Open sourcecybersecuritynews.com
Open sourcecsoonline.com
Open sourcehelpnetsecurity.com
Open sourcessd-disclosure.com
Open sourcecisco.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco disclosed and patched **`CVE-2026-20230`**, a high-severity server-side request forgery flaw in **Cisco Unified Communications Manager (Unified CM)** and **Unified CM Session Management Edition (SME)** WebDialer that can let an unauthenticated attacker write arbitrary files via crafted `file://` requests and escalate privileges to **root**. The issue affects deployments where **WebDialer** is enabled; although the feature is disabled by default, it is commonly used in enterprise VoIP environments. Cisco issued fixes in early June, including **Unified CM 14SU6**, while an interim **COP** patch was made available for release 15 pending a broader **15SU5** update.
Jul 10, 2026
Cisco disclosed **CVE-2026-20230**, a server-side request forgery vulnerability in **Cisco Unified Communications Manager (Unified CM)** and **Unified CM Session Management Edition (Unified CM SME)** that can be exploited remotely without authentication. The flaw stems from improper input validation in specific HTTP requests, and Cisco said successful exploitation could let an attacker write files to the underlying operating system and later escalate privileges to **root**. Cisco assigned the issue a **Critical** security impact rating even though the CVSS v3.1 profile is listed as High severity. The vulnerability affects **Release 14** versions prior to **14SU6** and **Release 15** versions prior to **15SU5** or the relevant **COP** update. Cisco noted that exploitation requires the **WebDialer** service to be enabled, and that service is disabled by default, but Canadian authorities warned that **proof-of-concept exploit code is available** and urged organizations to review Cisco’s advisory and apply updates promptly.
Jun 29, 2026
Cisco released fixes for a **critical remote code execution** vulnerability in Unified Communications and *Webex Calling Dedicated Instance*, tracked as **CVE-2026-20045**, after it was **actively exploited as a zero-day**. The issue stems from **improper validation of user-supplied input in HTTP requests** to the web-based management interface; successful exploitation can provide **user-level OS access** and enable **privilege escalation to root**. Affected products include **Cisco Unified Communications Manager (Unified CM)**, **Unified CM Session Management Edition (SME)**, **Unified CM IM & Presence**, **Cisco Unity Connection**, and **Webex Calling Dedicated Instance**; Cisco provided version-specific remediations including fixed releases and `.cop` patch files (e.g., `ciscocm.V14SU4a_CSCwr21851_remote_code_v1.cop.sha512`). CISA added **CVE-2026-20045** to its **Known Exploited Vulnerabilities (KEV) Catalog**, citing evidence of active exploitation and highlighting code injection flaws as a common attack vector with significant risk to the federal enterprise. Under **Binding Operational Directive (BOD) 22-01**, Federal Civilian Executive Branch agencies are required to remediate KEV-listed vulnerabilities by the specified due date, and CISA urged all organizations to similarly prioritize patching to reduce exposure to ongoing attacks.
Jun 29, 2026