Loading vulnerability…
CVE-2026-20230 is a server-side request forgery vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME). The flaw is caused by improper input validation in the WebDialer service when handling specific HTTP requests. An unauthenticated remote attacker can send a crafted HTTP request to a vulnerable system and coerce the application into making unintended internal requests. Successful exploitation can be leveraged to write attacker-controlled files to the underlying operating system. That file-write primitive can then be used in a subsequent stage to obtain root privileges on the appliance. Cisco assigned the issue a Critical security impact rating because exploitation crosses component boundaries from the web application into the underlying operating system and can lead to full host compromise.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Repository contains a single Python PoC exploit and a README describing the attack chain and defensive considerations. The main file, CVE-2026-20230-poc.py, is a standalone command-line exploit that targets Cisco CUCM by chaining unauthenticated web access, hostname discovery from WebDialer WSDL, SSRF through the cmplatform install status endpoint, Axis service abuse, arbitrary file write, and final JSP-based command execution. The exploit is structured as a staged workflow: get_hostname() retrieves the real internal hostname from /webdialer/Version.jws?wsdl; ssrf_create_axis_service() sends a crafted request to /cmplatform/installClusterStatusExecute with a doubly encoded Axis deployment descriptor that creates a service named randomR11 and abuses org.apache.axis.handlers.LogHandler to write aaa.jsp into the Tomcat axis2-web directory; later stages verify the service, write an initial JSP dropper, write a second JSP command shell (c.jsp), and execute an operator-supplied command such as id. The script supports a --check mode, target/port selection, and command selection, indicating practical exploit intent rather than mere detection. The README is extensive and mostly explanatory, covering prerequisites such as WebDialer needing to be enabled, affected product context, attack-chain rationale, detection opportunities, and mitigation guidance. Overall, this is a real operational PoC for unauthenticated SSRF-to-arbitrary-file-write-to-RCE against CUCM, not just a scanner or documentation-only repository.
Small single-script Python repository containing a Cisco Unified CM CVE-2026-20230 scanner and PoC tester. Repository structure is minimal: one executable Python script, a README, dependency file, license, and .gitignore. The main script uses requests, urllib3, argparse, and colorama. Core capabilities: 1) Recon/fingerprinting: scan_target() sends GET requests to several Cisco Unified CM-related paths (/webdialer/Webdialer, /webdialer/Cisco_WebDialer_Service, /ccmadmin/showHome.do, /login.jsp, /cmplatform/, /cucm-uds/) and looks for response markers such as 'cucm', 'unified cm', 'webdialer', and version-like strings '14.'/'15.'. 2) Service detection: check_webdialer() probes likely WebDialer endpoints and flags the service as enabled when HTTP 200/403 responses contain WebDialer-related strings. 3) PoC testing: test_poc() submits a POST request to /webdialer/Webdialer with form fields dest and url set to file:// URIs, attempting to trigger a file-write primitive to an arbitrary path on the target. Success is inferred heuristically from status codes or response keywords. Important limitations: the script itself labels the POST body as a placeholder and explicitly says to replace it with real PoC parameters. Therefore, while it is exploit-oriented and includes an active write-test routine, it is not a complete weaponized exploit and does not contain a verified end-to-end root compromise chain. It is best characterized as an operational scanner/PoC harness rather than a polished exploit framework. No external hardcoded C2 or callback infrastructure is present. All network activity is direct client-to-target HTTP(S) requests. TLS verification is disabled, which helps against self-signed CUCM deployments. The script is interactive by default but supports automated PoC execution with --poc and a custom target file path via --file.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
269 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An improper validation flaw in Cisco Unified Communications Manager (Unified CM) and Unified Communications Manager Session Management Edition (Unified CM SME) that can enable SSRF, arbitrary file drop to the underlying OS, and potential root access. Cisco confirmed it is being exploited in the wild.
A Cisco Unified Communications Manager (Unified CM) server-side request forgery vulnerability that can be exploited remotely by unauthenticated attackers via crafted HTTP requests. It is significant because Cisco confirmed active exploitation in the wild and public proof-of-concept exploit code is available.
A server-side request forgery vulnerability in Cisco Unified Communications Manager and Cisco Unified CM Session Management Edition that can be triggered without valid credentials when the WebDialer service is enabled, potentially allowing file creation on the underlying OS and subsequent privilege escalation toward root.
A critical SSRF vulnerability in Cisco Unified Communications Manager and Unified CM SME that can let an unauthenticated attacker interact with internal services and potentially write files that could later be used to escalate privileges to root.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.