Cisco security advisory (AV26-547) – Update 1
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
Serial number: AV26-547 Date: June 3, 2026 Updated: June 25, 2026 On June 3, 2026, Cisco published security advisories to address vulnerabilities in multiple products. Included was a critical update for the following: Cisco Unified Communications Manager (CM) Release 14 – versions prior to 14SU6 Cisco Unified Communications Manager (CM) Release 15 – versions prior to 15SU5 (Sep 2026) or COP Cisco Unified Communications Manager Session Management Edition (CM SME) release 14 – versions prior to 14SU6 Cisco Unified Communications Manager Session Management Edition (CM SME) release 15 – versions prior to 15SU5 (Sep 2026) or COP Cisco has indicated that a proof-of-concept exploit code is available for CVE-2026-20230. Update 1 On June 25, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20230 to their Known Exploited Vulnerabilities (KEV) Database. The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates. Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability Cisco Security Advisories CISA KEV: CVE-2026-20230
CSIRTS triage
- What
- This advisory addresses vulnerabilities in Cisco Unified Communications Manager.
- Who is affected
- Deployments of Cisco Unified Communications Manager Release 14 and 15 are affected.
- Urgency
- Remediation is critical due to active exploitation and the availability of proof-of-concept exploit code.
- Action
- Update to Cisco Unified Communications Manager Release 14SU6 or 15SU5.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Unified Communications Manager
Get an email when a new Unified Communications Manager advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://cyber.gc.ca/en/alerts-advisories/cisco-security-advisory-av26-547
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2026-20230Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 99% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-20230 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- criticalexploitedCisco Unified Communications Manager Server-Side Request Forgery Vulnerabilitycisco-psirt
- highexploitedCISA Adds Two Known Exploited Vulnerabilities to Catalogcisa
- criticalexploitedCVE-2026-20230: Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerabilitycisa-kev
More from Canadian Centre for Cyber Security
- unknownBitWarden security advisory (AV26-683)2026-07-10
- criticalAL25-007 - Vulnerability impacting Roundcube Webmail – CVE-2025-49113 – Update 12026-07-10
- unknownMicrosoft Edge security advisory (AV26-682)2026-07-10
- criticalBroadcom VMware security advisory (AV26-681)2026-07-10
- unknownDjango security advisory (AV26-084) – Update 12026-07-09