CVE-2026-20230

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-20230 8.6

Cisco · Unified Communications Manager · Added 2026-06-25 · Published 2026-06-03

3-Day Required PoC Available KEV Active Exploitation

Details

VulnerabilityCisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability

VendorCisco

ProductUnified Communications Manager

Date added2026-06-25

Due date2026-06-28

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-918

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Descriptions

KEV: Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) Vulnerability that could allow an unauthenticated, remote attacker to write files to the underlying operating system that could be used later to elevate to root.

NVD: A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root. Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root. Note: To exploit this vulnerability, the WebDialer service must be enabled. WebDialer is disabled by default.

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-08-27 14:30 UTC

Wall time3.4s

Searches1

Component defaultno

Sources https://nvd.nist.gov/vuln/detail/CVE-2026-20230
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW
https://horizon3.ai/attack-research/vulnerabilities/cve-2026-20230/
https://threat-modeling.com/cve-2026-20230-cisco-unified-communications-manager-ssrf-rce/
https://github.com/HORKimhab/CVE-2026-20230
https://github.com/W5M1n9/Cisco-Unified-Communications-Manager-Server-Side-Forgery-Request-Vulnerability-CVE-2026-20230
https://www.bleepingcomputer.com/news/security/cisco-unified-cm-sme-flaw-cve-2026-20230-now-exploited-in-attacks/

QC notes

info precondition_contradiction: Preconditions don't mention deployment applicability (component/product version)

Hunting hypothesis agent

Hunt WebDialer access logs for GET /webdialer/Version.jws?wsdl followed by POST /cmplatform/installClusterStatusExecute with hostname param containing %2f or Axis keywords (wsdd, LogHandler) indicating SSRF-to-file-write.

Research details

ComponentCisco Unified CM WebDialer cmplatform installClusterStatusExecute SSRF endpoint

PreconditionsNetwork reachability to Cisco Unified CM or Unified CM SME management interface on HTTP/HTTPS; WebDialer service must be enabled (disabled by default); no authentication required; versions prior to 14SU6 or 15SU5. The attacker needs to extract the real hostname from WebDialer WSDL first, then use it in the SSRF chain. agent

DeliveryTwo-stage SSRF: (1) GET /webdialer/Version.jws?wsdl to extract real hostname, (2) POST /cmplatform/installClusterStatusExecute with hostname param containing Axis/WSDD path traversal to deploy malicious service and write JSP webshell

Public PoCyes

PoC URLs https://github.com/HORKimhab/CVE-2026-20230
https://github.com/W5M1n9/Cisco-Unified-Communications-Manager-Server-Side-Forgery-Request-Vulnerability-CVE-2026-20230 Third-party repos; verify before use.

Advisoryhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW

Exploit notesCVSS 8.6 HIGH (rated Critical by Cisco due to root escalation) | No auth required but WebDialer disabled by default | Two-stage exploit: (1) extract real hostname from WebDialer WSDL at /webdialer/Version.jws?wsdl, (2) SSRF via /cmplatform/installClusterStatusExecute with hostname param containing path traversal to reach internal Axis/AdminService endpoints, (3) deploy malicious Axis WSDD service descriptor, (4) write JSP webshell via the deployed service, (5) access JSP to achieve RCE as root | Hostname filtering blocks 127.0.0.1/localhost but the real hostname is accepted | Axis WSDD fields (deployment, requestFlow, LogHandler, allowedMethods, className, fileName) appear in exploitation traffic | Public PoC repos on GitHub with full chain documented | Actively exploited in the wild

SummaryCisco Unified CM SSRF vulnerability (CWE-918) in the WebDialer cmplatform installClusterStatusExecute endpoint allows unauthenticated remote attackers to force the application to make unintended server-side requests. The exploit chain extracts the real hostname from WebDialer WSDL, uses it to bypass localhost filtering via SSRF, deploys a malicious Axis WSDD service, writes a JSP webshell, and achieves RCE as root. WebDialer must be enabled (disabled by default). Patch to 14SU6 or 15SU5.

Tia coverage

First reported2026-06-04

First exploit report2026-07-03

Exploit report → KEV8 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cisco-unified-cm-cve-2026-20230-critical-ssrf-with-public-poc-we

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.