Cisco Unified CM Flaw Faces Active Exploitation After PoC Release

Attackers are actively exploiting CVE-2026-20230, a critical flaw in Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (Unified CM SME), shortly after technical details and proof-of-concept code became public. Cisco said the bug stems from improper input validation in certain HTTP requests and can let an unauthenticated attacker perform SSRF, write arbitrary files to the underlying operating system, and potentially escalate privileges to root; researchers also described a path to unauthenticated remote code execution. Exploitation requires the WebDialer service to be enabled, although Cisco notes it is disabled by default.

Exploit intelligence firm Defused reported seeing attacks from a single source using an unvetted PoC, with file:// file-write payloads observed against decoy systems over the weekend. Cisco patched the issue in Unified CM 14SU6 and 15SU5, while SSD Secure Disclosure, which reported the vulnerability, published additional technical details showing how attackers could recover a target's true hostname and progress toward code execution. Cisco has advised customers to apply the fixes and, if patching cannot be done immediately, disable WebDialer to reduce exposure on widely deployed enterprise voice platforms.