CVE-2026-20230 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-06-03

Added to CISA KEV: 2026-06-25 22 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: This vulnerability is in CISA KEV with confirmed active exploitation and webshell deployment. Immediately hunt for indicators of compromise - inspect for unexpected files/webshells in web directories, unusual outbound HTTP requests originating from CUCM, unauthorized OS-level files, and root privilege escalation artifacts.
IMMEDIATE: Upgrade CUCM/Unified CM SME to the fixed release per cisco-sa-cucm-ssrf-cXPnHcW. Treat as emergency patch priority.
MITIGATION: If patching cannot be done immediately, disable the WebDialer service on all installations where it is not strictly required (it is disabled by default).
NETWORK: Ensure CUCM web/admin interfaces are NOT exposed to the internet; restrict access via firewall/ACLs to trusted management networks only. Front internet-facing access with Expressway/MRA where appropriate.
MONITORING: Deploy detection for anomalous HTTP requests to WebDialer endpoints and SSRF-style callbacks; monitor CUCM filesystem integrity and privilege escalation to root.
PATCH PRIORITY: EMERGENCY / P1 - actively exploited, unauthenticated, root-level impact.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-20230 is a critical server-side request forgery (SSRF) vulnerability affecting the WebDialer service in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME). The flaw stems from improper input validation of HTTP requests, which allows an unauthenticated, remote attacker to manipulate the device into making unauthorized requests to internal resources. This vulnerability is significant because it provides a mechanism for attackers to bypass network perimeters and potentially access sensitive internal infrastructure or deploy malicious payloads, such as webshells.

Exploitation

Active Exploitation: The vulnerability is being actively exploited in the wild, with reports indicating its use to drop webshells on affected systems ^[4].
Threat Actors/Campaigns: While specific attribution may vary, the active exploitation of this flaw to facilitate persistence (webshells) suggests targeted attacks against organizations using Cisco Unified CM.
Proof-of-Concept/Exploit Availability: Public repositories, such as those on GitHub, have surfaced containing research-oriented materials and educational PoCs related to this CVE ^[1].
Attack Prerequisites:

* Network: Remote access is required (the vulnerability is reachable over the network) ^[2]. * Authentication: None; the exploit is possible by an unauthenticated attacker ^[2]. * User Interaction: No user interaction is required for successful exploitation.

Affected Products & Patches

Affected Products: Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME).
Patch/Hotfix: Cisco has released security updates to address this vulnerability. Administrators are advised to apply the latest official patches provided by Cisco to their specific version of Unified CM.
Mitigations: If patching is not immediately feasible, it is recommended to disable the WebDialer service on all CUCM installations where the service is not strictly required ^[3].

Impact

Access & Capability: Successful exploitation allows an attacker to conduct SSRF attacks, enabling them to send arbitrary HTTP requests from the perspective of the vulnerable server. This can lead to unauthorized access to internal network services, information disclosure, or the deployment of persistent threats like webshells.
Business Risk: For internet-facing deployments, this vulnerability poses a severe risk as it exposes internal management and communications infrastructure to the public internet. Compromise can lead to full system takeover, unauthorized lateral movement within the network, and potential disruption of critical communication services.

Sources

HORKimhab/CVE-2026-20230 - Cisco Unified CM
Purpose. This repository is for educational and authorized security research only. It is designed to help users learn about: Security vulnerabilities; Sandbox ... CVE-2026-20230 - Cisco Unified CM. Contribute to HORKimhab/CVE-2026-20230 development by creating an account on GitHub.
Cisco Unified Communications Manager Server-Side ...
CVE-2026-20230 ・ could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks ・ due to improper ... A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could…
CVE-2026-20230 - Vulnerability Details - OpenCVE
Apply the latest Cisco Unified Communications Manager patch that fixes CVE-2026-20230. Disable the WebDialer service on all CUCM installations unless the service is strictly required.
Cisco Unified CM flaw actively exploited to drop webshells ...
CVE-2026-20230, a SSRF vulnerability affecting Cisco's Unified Communications Manager (Unified CM), is being exploited to drop webshells.

🔴 CVE-2026-20230