CVE-2026-20045: Cisco Unified Communications Products code injection in management interface

CVE-2026-20045 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2026-01-21

Cisco Unified Communications products, which manage corporate telephony, messaging, and collaboration services, are affected by a critical security flaw. An unauthenticated attacker can remotely take full control of the underlying server by sending malicious web requests. This could lead to a total compromise of the communication system, allowing attackers to intercept data, disrupt operations, or gain a foothold in the corporate network.

Technologies: Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, Cisco Unified Communications Manager Session Management Edition, Cisco Unity Connection. Vendors: Cisco.

Quick answers

Is CVE-2026-20045 exploited in the wild?
Yes. CVE-2026-20045 is known to be exploited in the wild, first recorded on 21 January 2026. Treat it as urgent.
How severe is CVE-2026-20045?
Critical severity, with a CVSS score of 9.8, published 21 January 2026.
Which products and versions are affected?
Cisco Unified Communications Manager 12.5 to 14su5, 15.0 to 15su3a; Cisco Unified Communications Manager IM & Presence Service 12.5 to 14su5, 15.0 to 15su3a; Cisco Unified Communications Manager Session Management Edition 12.5 to 14su5, 15.0 to 15su3a; Cisco Unity Connection 12.5 to 14su5, 15.0 to 15su3a.
Is there a fix for CVE-2026-20045?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20045 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-20045?
Check whether you run Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, Cisco Unified Communications Manager Session Management Edition or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A code injection vulnerability (CWE-94) exists in the web-based management interface of several Cisco Unified Communications products due to improper validation of user-supplied input in HTTP requests. An unauthenticated, remote attacker can exploit this by sending a sequence of crafted HTTP requests to the affected device. Successful exploitation allows the attacker to execute arbitrary commands on the underlying operating system with user-level access and subsequently elevate privileges to root. This vulnerability is confirmed to be exploited in the wild and has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog.

Affected products

  • Cisco Unified Communications Manager (Unified CM) 12.5 to 14su5, 15.0 to 15su3a
  • Cisco Unified Communications Manager Session Management Edition (Unified CM SME) 12.5 to 14su5, 15.0 to 15su3a
  • Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) 12.5 to 14su5, 15.0 to 15su3a
  • Cisco Unity Connection 12.5 to 14su5, 15.0 to 15su3a
  • Cisco Webex Calling Dedicated Instance

Timeline

  • 2026-01-21: advisory: Initial advisory published by Cisco
  • 2026-01-21: kev added: Added to CISA Known Exploited Vulnerabilities catalog
  • 2026-01-21: exploited: Reported as exploited in the wild

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.