CVE-2026-20230: Cisco Unified Communications Manager SSRF in WebDialer

CVE-2026-20230 · Severity: critical · CVSS 8.6 · Exploited in the wild · Published 2026-06-03

Cisco Unified Communications Manager, a system used for enterprise IP telephony and video calls, contains a security flaw that allows an unauthorized person to send malicious requests to the server. By exploiting this flaw, an attacker could remotely place files on the system's internal storage, which can then be used to gain full administrative control (root access) over the device. This could lead to a complete compromise of the communication system, allowing attackers to intercept calls or disrupt services.

Technologies: Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition. Vendors: Cisco.

Quick answers

Is CVE-2026-20230 exploited in the wild?
Yes. CVE-2026-20230 is known to be exploited in the wild, first recorded on 25 June 2026. Treat it as urgent.
How severe is CVE-2026-20230?
Critical severity, with a CVSS score of 8.6, published 3 June 2026.
Which products and versions are affected?
Cisco Unified Communications Manager 14 before 14SU6, 15 before 15SU5; Cisco Unified Communications Manager Session Management Edition 14 before 14SU6, 15 before 15SU5.
Is there a fix for CVE-2026-20230?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20230 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-20230?
Check whether you run Cisco Unified Communications Manager or Cisco Unified Communications Manager Session Management Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Cisco Unified Communications Manager (Unified CM) and Session Management Edition (Unified CM SME) due to improper input validation of specific HTTP requests. An unauthenticated, remote attacker can exploit this by sending crafted HTTP requests to an affected device where the WebDialer service is enabled. Successful exploitation allows the attacker to perform arbitrary file writes to the underlying operating system. These files can subsequently be leveraged to achieve privilege escalation to root. While the CVSS score is 8.6, Cisco has classified this as Critical due to the potential for full system compromise. Note that the WebDialer service is disabled by default.

Affected products

  • Cisco Unified Communications Manager (Unified CM)
  • Cisco Unified Communications Manager Session Management Edition (Unified CM SME)

Timeline

  • 2026-06-03: disclosed
  • 2026-06-03: advisory
  • 2026-06-25: other: NVD record updated

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.