# CVE-2026-20045: Cisco Unified Communications Products code injection in management interface

Source: https://junglewise.ai/threats/cve-2026-20045-cisco-unified-communications-products-code-injection-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-21. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2026-20045 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2026-01-21

Cisco Unified Communications products, which manage corporate telephony, messaging, and collaboration services, are affected by a critical security flaw. An unauthenticated attacker can remotely take full control of the underlying server by sending malicious web requests. This could lead to a total compromise of the communication system, allowing attackers to intercept data, disrupt operations, or gain a foothold in the corporate network.

Technologies: [Cisco Unified Communications Manager](https://junglewise.ai/threats/technologies/unified-communications-manager), [Cisco Unified Communications Manager IM & Presence Service](https://junglewise.ai/threats/technologies/unified-communications-manager-im-presence-service), [Cisco Unified Communications Manager Session Management Edition](https://junglewise.ai/threats/technologies/unified-communications-manager-session-management-edition), [Cisco Unity Connection](https://junglewise.ai/threats/technologies/unity-connection). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-20045 exploited in the wild?** Yes. CVE-2026-20045 is known to be exploited in the wild, first recorded on 21 January 2026. Treat it as urgent.

**How severe is CVE-2026-20045?** Critical severity, with a CVSS score of 9.8, published 21 January 2026.

**Which products and versions are affected?** Cisco Unified Communications Manager 12.5 to 14su5, 15.0 to 15su3a; Cisco Unified Communications Manager IM & Presence Service 12.5 to 14su5, 15.0 to 15su3a; Cisco Unified Communications Manager Session Management Edition 12.5 to 14su5, 15.0 to 15su3a; Cisco Unity Connection 12.5 to 14su5, 15.0 to 15su3a.

**Is there a fix for CVE-2026-20045?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-20045 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-20045?** Check whether you run Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, Cisco Unified Communications Manager Session Management Edition or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A code injection vulnerability (CWE-94) exists in the web-based management interface of several Cisco Unified Communications products due to improper validation of user-supplied input in HTTP requests. An unauthenticated, remote attacker can exploit this by sending a sequence of crafted HTTP requests to the affected device. Successful exploitation allows the attacker to execute arbitrary commands on the underlying operating system with user-level access and subsequently elevate privileges to root. This vulnerability is confirmed to be exploited in the wild and has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog.

## Affected products

- Cisco Unified Communications Manager (Unified CM) 12.5 to 14su5, 15.0 to 15su3a
- Cisco Unified Communications Manager Session Management Edition (Unified CM SME) 12.5 to 14su5, 15.0 to 15su3a
- Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) 12.5 to 14su5, 15.0 to 15su3a
- Cisco Unity Connection 12.5 to 14su5, 15.0 to 15su3a
- Cisco Webex Calling Dedicated Instance

## Timeline

- 2026-01-21: advisory: Initial advisory published by Cisco
- 2026-01-21: kev added: Added to CISA Known Exploited Vulnerabilities catalog
- 2026-01-21: exploited: Reported as exploited in the wild

## Related threats

- [Cisco Unified Communications Manager cross-site scripting in web interface](https://junglewise.ai/threats/cve-2026-76419-a-vulnerability-in-the-web-based-management-interface-of-cisco)
- [Cisco Unified Communications Manager access control bypass](https://junglewise.ai/threats/cve-2026-76487-a-vulnerability-in-cisco-unified-communications-manager-unified)
- [Cisco Unified Communications Products improper exception handling](https://junglewise.ai/threats/cve-2026-76481-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Cisco Unified Communications Products path traversal in security hardening](https://junglewise.ai/threats/cve-2026-76479-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)
- [Cisco Unified Communications Products improper access control](https://junglewise.ai/threats/cve-2026-76478-as-part-of-cisco-s-ongoing-commitment-to-proactive-security-and)