Reported by 2 outlets

Timeline

1. original reporting

   Cisco Unified CM CVE-2026-20230 — Critical SSRF with Public PoC, WebDialer Required, Patches Available

   securityweek.com · 132d ago · June 4th, 2026

   Cisco disclosed a critical server-side request forgery vulnerability in Unified Communications Manager (Unified CM) and Unified CM Session Management Edition, warning that proof-of-concept exploit code is publicly available. Tracked as CVE-2026-20230 (CVSS 8.6, Cisco rates it Critical), the flaw stems from improper HTTP input validation in the WebDialer service — disabled by default but commonly enabled in enterprise deployments for click-to-call CTI functionality.

   An unauthenticated remote attacker sends a crafted HTTP request to write arbitrary files to the underlying OS, then escalates those file-write primitives to root access.

   Fixed releases: Unified CM 14SU6 is available now. Release 15 users must wait for 15SU5 (September 2026) or apply the interim COP patch. No active exploitation confirmed at disclosure, but public PoC dramatically accelerates the window. Action: Disable WebDialer immediately if non-essential; apply 14SU6 or COP patches as priority.

   ---

2. update from bleepingcomputer.com

   Cisco Unified CM CVE-2026-20230 Actively Exploited — SSRF Vulnerability Grants Root Access on Voice Servers

   bleepingcomputer.com · 112d ago · June 24th, 2026

   Threat actors are actively exploiting CVE-2026-20230, a high-severity SSRF vulnerability (CVSS 8.6) in Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition, with exploitation observed over the weekend. The flaw, patched by Cisco on June 3, allows unauthenticated remote attackers to abuse the WebDialer component's handling of user-supplied URLs to write arbitrary files to the OS via file:// URIs — ultimately achieving root privileges. Threat intelligence firm Defused confirmed attacks originating from a single IP address using properly constructed file:// payloads. The observed PoC appears designed for reconnaissance — writing a test file (/tmp/cve-2026-20230-test.txt) to vulnerable devices — but now that SSD Secure has published a full technical write-up and PoC exploit, broader weaponized exploitation is expected. CISA has not yet added this CVE to KEV. Hunting hypothesis: Monitor for HTTP requests to Unified CM WebDialer endpoints containing file:// URI schemes from unexpected IPs. Check for unexpected files written to /tmp/ on CUCM appliances. Recommended action: Patch immediately if running affected Unified CM versions. This is internet-facing voice infrastructure — treat as crown-jewel priority.

3. update from bleepingcomputer.com

   Cisco Confirms Attackers Exploiting Unified CM Vulnerability (CVE-2026-20230) — SSRF Flaw Enables Remote Server Takeover

   bleepingcomputer.com · 103d ago · July 3rd, 2026

   Cisco's PSIRT acknowledged PoC exploit code was publicly available at patch time (June 3) but only confirmed active exploitation on June 22, three weeks later, when threat intelligence firm Defused revealed attackers were using file:// payloads to create files on targeted devices. Shadowserver currently tracks over 200 exposed Unified CM instances, most in Asia and North America. Cisco has shared mitigation measures including disabling the vulnerable WebDialer service. Disable WebDialer service as a temporary mitigation if patching is delayed.