Loading story…
Cisco disclosed and patched CVE-2026-20230, a high-severity server-side request forgery flaw in Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME) WebDialer that can let an unauthenticated attacker write arbitrary files via crafted file:// requests and escalate privileges to root. The issue affects deployments where WebDialer is enabled; although the feature is disabled by default, it is commonly used in enterprise VoIP environments. Cisco issued fixes in early June, including Unified CM 14SU6, while an interim COP patch was made available for release 15 pending a broader 15SU5 update.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
CISA added CVE-2026-20230 to its Known Exploited Vulnerabilities catalog on 2026-06-25 and set a remediation due date of 2026-06-28. The listing reflected the vulnerability's active exploitation status and elevated urgency for remediation.
Public proof-of-concept code and technical details for CVE-2026-20230 were published, increasing the likelihood of broader exploitation. The source content does not provide a specific date for this publication.
Defused observed active exploitation of CVE-2026-20230 on June 20-21, 2026, apparently originating from a single IP address. The activity included reconnaissance attempts to create /tmp/cve-2026-20230-test.txt on vulnerable Cisco Unified CM systems.
Cisco released fixes for the high-severity SSRF vulnerability CVE-2026-20230 in Unified CM and Unified CM SME WebDialer on June 3, 2026. The update included Unified CM 14SU6, while an interim COP patch for release 15 was pending ahead of full 15SU5 planned for September 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
threataft.com
Open sourcevulnerability.circl.lu
Open sourceegfincirt-wpn.azurewebsites.net
Open sourceegfincirt-wpn.azurewebsites.net
Open sourceegfincirt.org.eg
Open sourcezeropath.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco disclosed **CVE-2026-20230**, a server-side request forgery vulnerability in **Cisco Unified Communications Manager (Unified CM)** and **Unified CM Session Management Edition (Unified CM SME)** that can be exploited remotely without authentication. The flaw stems from improper input validation in specific HTTP requests, and Cisco said successful exploitation could let an attacker write files to the underlying operating system and later escalate privileges to **root**. Cisco assigned the issue a **Critical** security impact rating even though the CVSS v3.1 profile is listed as High severity. The vulnerability affects **Release 14** versions prior to **14SU6** and **Release 15** versions prior to **15SU5** or the relevant **COP** update. Cisco noted that exploitation requires the **WebDialer** service to be enabled, and that service is disabled by default, but Canadian authorities warned that **proof-of-concept exploit code is available** and urged organizations to review Cisco’s advisory and apply updates promptly.
Jun 29, 2026
Attackers are actively exploiting **CVE-2026-20230**, a critical flaw in Cisco Unified Communications Manager (**Unified CM**) and Unified CM Session Management Edition (**Unified CM SME**), shortly after technical details and proof-of-concept code became public. Cisco said the bug stems from improper input validation in certain HTTP requests and can let an unauthenticated attacker perform **SSRF**, write arbitrary files to the underlying operating system, and potentially escalate privileges to **root**; researchers also described a path to unauthenticated remote code execution. Exploitation requires the **WebDialer** service to be enabled, although Cisco notes it is disabled by default. Exploit intelligence firm Defused reported seeing attacks from a single source using an unvetted PoC, with `file://` file-write payloads observed against decoy systems over the weekend. Cisco patched the issue in **Unified CM 14SU6** and **15SU5**, while SSD Secure Disclosure, which reported the vulnerability, published additional technical details showing how attackers could recover a target's true hostname and progress toward code execution. Cisco has advised customers to apply the fixes and, if patching cannot be done immediately, disable **WebDialer** to reduce exposure on widely deployed enterprise voice platforms.
Jul 2, 2026
Cisco released fixes for a **critical remote code execution** vulnerability in Unified Communications and *Webex Calling Dedicated Instance*, tracked as **CVE-2026-20045**, after it was **actively exploited as a zero-day**. The issue stems from **improper validation of user-supplied input in HTTP requests** to the web-based management interface; successful exploitation can provide **user-level OS access** and enable **privilege escalation to root**. Affected products include **Cisco Unified Communications Manager (Unified CM)**, **Unified CM Session Management Edition (SME)**, **Unified CM IM & Presence**, **Cisco Unity Connection**, and **Webex Calling Dedicated Instance**; Cisco provided version-specific remediations including fixed releases and `.cop` patch files (e.g., `ciscocm.V14SU4a_CSCwr21851_remote_code_v1.cop.sha512`). CISA added **CVE-2026-20045** to its **Known Exploited Vulnerabilities (KEV) Catalog**, citing evidence of active exploitation and highlighting code injection flaws as a common attack vector with significant risk to the federal enterprise. Under **Binding Operational Directive (BOD) 22-01**, Federal Civilian Executive Branch agencies are required to remediate KEV-listed vulnerabilities by the specified due date, and CISA urged all organizations to similarly prioritize patching to reduce exposure to ongoing attacks.
Jun 29, 2026