CVE-2026-20230
Actively exploited. CVE-2026-20230 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2026-06-25) — exploitation has been observed in the wild, and US federal agencies are required to remediate it under BOD 22-01. Treat patching as urgent.
Public exploit code is available. Proof-of-concept or working exploit code for CVE-2026-20230 is indexed in GitHub PoC. Expect opportunistic scanning and exploitation attempts — prioritize remediation.
Serial number: AV26-547 Date: June 3, 2026 Updated: June 25, 2026 On June 3, 2026, Cisco published security advisories to address vulnerabilities in multiple products. Included was a critical update for the following: Cisco Unified Communications Manager (CM) Release 14 – versions prior to 14SU6 Cisco Unified Communications Manager (CM) Release 15 – versions prior to 15SU5 (Sep 2026) or COP Cisco Unified Communications Manager Session Management Edition (CM SME) release 14 – versions prior to 14SU6 Cisco Unified Communications Manager Session Management Edition (CM SME) release 15 – versions prior to 15SU5 (Sep 2026) or COP Cisco has indicated that a proof-of-concept exploit code is available for CVE-2026-20230. Update 1 On June 25, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20230 to their Known Exploited Vulnerabilities (KEV) Database. The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates. Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability Cisco Security Advisories CISA KEV: CVE-2026-20230
CSIRTS triage
- What
- This advisory addresses vulnerabilities in Cisco Unified Communications Manager.
- Who is affected
- Deployments of Cisco Unified Communications Manager Release 14 and 15 are affected.
- Urgency
- Remediation is critical due to active exploitation and the availability of proof-of-concept exploit code.
- Action
- Update to Cisco Unified Communications Manager Release 14SU6 or 15SU5.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-20230
Get an email if CVE-2026-20230 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Exploitation confirmedAlready exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 99% of all EPSS-scored CVEs.
Exploit availability
Public exploit or proof-of-concept code for CVE-2026-20230 is indexed in these free datasets. Available exploit code raises real-world risk independent of the CVSS score.
- GitHub PoCPublic proof-of-concept repositories on GitHub reference this CVE.look it up ↗
Advisory coverage (4)
- criticalexploitedCisco Unified Communications Manager Server-Side Request Forgery Vulnerabilitycisco-psirt · 2026-07-01
- criticalexploitedCisco security advisory (AV26-547) – Update 1cccs · 2026-06-25
- highexploitedCISA Adds Two Known Exploited Vulnerabilities to Catalogcisa · 2026-06-25
- criticalexploitedCVE-2026-20230: Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerabilitycisa-kev · 2026-06-25
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-20230)