Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root . Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root . Note: To exploit this vulnerability, the WebDialer service must be enabled. WebDialer is disabled by default. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW Security Impact Rating: Critical CVE: CVE-2026-20230
CSIRTS triage
- What
- A server-side request forgery vulnerability allows remote attackers to exploit the device.
- Who is affected
- Cisco Unified Communications Manager and Session Management Edition users are affected.
- Urgency
- Remediation is urgent due to active exploitation and critical severity.
- Action
- Update to the latest version of Cisco Unified Communications Manager.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Unified Communications Manager
Get an email when a new Unified Communications Manager advisory drops — max one per day, one-click unsubscribe.
Details
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2026-20230Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 99% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-20230 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- criticalexploitedCisco security advisory (AV26-547) – Update 1cccs
- highexploitedCISA Adds Two Known Exploited Vulnerabilities to Catalogcisa
- criticalexploitedCVE-2026-20230: Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerabilitycisa-kev
Recent advisories for Cisco Unified Communications
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- criticalexploitedCVE-2026-20230: Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerabilitycisa-kev · 2026-06-25
- criticalexploitedCVE-2026-20045: Cisco Unified Communications Products Code Injection Vulnerabilitycisa-kev · 2026-01-21
More from Cisco Security Advisories
- unknownCisco Advance Notification for Publication of July 15, 2026, Security Advisories2026-07-08
- criticalCisco Identity Services Engine Remote Code Execution and Information Disclosure Vulnerabilities2026-07-06
- highCisco Catalyst Center Arbitrary File Read Vulnerability2026-07-06
- highClamAV Vulnerabilities Affecting Cisco Products: July 20262026-07-02
- highCisco Advance Notification for Publication of July 1, 2026, Security Advisories2026-07-01