CVE-2026-20045
Cisco Unified Communications Products Code Injection Vulnerability
Description
CVE-2026-20045 is a high-severity code injection vulnerability (CVSS 8.2) affecting Cisco Unified Communications Manager (Unified CM), Unified CM Session Management Edition, Unified CM IM & Presence Service, Unity Connection, and Webex Calling Dedicated Instance. The flaw allows an unauthenticated remote attacker to execute arbitrary commands on the underlying operating system by exploiting improper input validation. This vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of February 11, 2026, and its EPSS score of 0.00996 places it in the 76.6th percentile, indicating moderate exploitation probability. Ransomware association is currently classified as unknown.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | unified communications manager | >= 12.5, < 14su5; >= 15.0, <= 15su3a |
| cisco | unified communications manager im and presence service | >= 12.5, < 14su5; >= 15.0, <= 15su3a |
| cisco | unity connection | >= 12.5, < 14su5; >= 15.0, <= 15su3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-94 describes vulnerabilities where software constructs code segments using externally-influenced input without properly neutralizing special elements that could modify the intended code syntax or behavior. In the context of CVE-2026-20045, the Cisco Unified Communications Manager fails to adequately sanitize user-supplied input before incorporating it into system-level commands, enabling an attacker to inject and execute arbitrary code on the underlying operating system. This weakness is particularly dangerous because it grants the attacker the ability to run commands with the privileges of the affected application.
Impact Analysis
The business impact of CVE-2026-20045 is substantial given the role Cisco Unified Communications Manager plays as the backbone of enterprise voice and video communications. Confidentiality is severely affected because the vulnerability allows an attacker to access sensitive data on the system, including call records, directory information, and internal network configurations, without needing any authentication. Integrity is partially compromised, as the attacker can modify system configurations and inject unauthorized commands, potentially disrupting call routing or embedding persistent backdoors. Availability is not directly impacted according to the CVSS vector, but successful exploitation could lead to secondary disruption of communications services if the attacker chooses to degrade or sabotage the platform. The EPSS score of 0.00996 (76.6th percentile) indicates that while exploitation activity is not yet widespread, the vulnerability is being actively targeted in the wild as confirmed by its KEV listing. Organizations relying on Cisco UC infrastructure face the risk of full network reconnaissance and lateral movement if this vulnerability is left unpatched, and the unknown ransomware classification means the possibility of ransomware actors leveraging this flaw cannot be ruled out.
Exploit Maturity
CVE-2026-20045 has been confirmed as actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a mandatory remediation deadline of February 11, 2026. This KEV designation means that federal agencies and organizations following CISA guidance are required to remediate the vulnerability by that date. The EPSS score of 0.00996 places it in the 76.6th percentile, meaning it has a higher predicted exploitation probability than roughly three-quarters of all scored vulnerabilities. While no public proof-of-concept exploit code has been independently tagged in the references, the active exploitation status confirmed by CISA indicates that threat actors already possess working exploits. The ransomware association is currently listed as unknown, meaning there is no confirmed link to ransomware campaigns, but given the remote code execution capability, this could change as threat intelligence evolves.
Remediation
- Apply the Cisco security patch immediately — Upgrade Cisco Unified Communications Manager, IM & Presence Service, and Unity Connection to version 14SU5 or later for the 12.5+ branch, or to the latest 15SU3a+ release for the 15.x branch. Consult the Cisco Security Advisory for the exact fixed software versions.
- Restrict network access to management interfaces — Implement firewall rules and access control lists to limit which hosts and networks can reach the Cisco UC administration and signaling ports, reducing the attack surface for unauthenticated exploitation.
- Monitor for indicators of compromise — Review system logs on Unified CM, Unity Connection, and IM & Presence Service for unusual command execution, unexpected process activity, or unauthorized configuration changes that could indicate prior exploitation.
- Segment your UC infrastructure — Place Cisco UC components in a dedicated network segment isolated from general user traffic and the broader corporate network to contain any compromise and limit lateral movement.
- Verify Webex Calling Dedicated Instance status — If you use Webex Calling Dedicated Instance, confirm with Cisco TAC or your Cisco partner that your instance has been updated, as patching may follow a different update cycle than on-premises deployments.
Technical Details
The CVSS v3.1 vector for CVE-2026-20045 is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, yielding a base score of 8.2 (High). Attack Vector (Network) means the vulnerability is exploitable remotely over the network without requiring physical or adjacent access, making it reachable from anywhere that can communicate with the affected service. Attack Complexity (Low) indicates that no special conditions or advanced techniques are needed to exploit the flaw — it is straightforward and repeatable. Privileges Required (None) confirms that the attacker does not need any authentication or user account to trigger the vulnerability, significantly increasing the risk. User Interaction (None) means no action from a legitimate user is needed for the attack to succeed. Scope (Unchanged) indicates the impact is contained within the vulnerable component's security authority. Confidentiality (High) reflects the attacker's ability to read highly sensitive data from the system. Integrity (Low) suggests limited but meaningful modification of data or system behavior is possible. Availability (None) means the vulnerability does not directly cause denial of service. The underlying attack mechanism involves sending specially crafted requests to the Cisco Unified CM web or signaling interfaces that contain injected code fragments. Due to insufficient input validation, these fragments are interpreted and executed as system commands on the underlying operating system, granting the attacker command-line access.
Frequently Asked Questions
What products are affected by CVE-2026-20045?
CVE-2026-20045 affects Cisco Unified Communications Manager (Unified CM), Unified CM Session Management Edition, Unified CM IM & Presence Service, Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance. Affected versions include the 12.5 through pre-14SU5 and 15.0 through 15SU3a release trains.
Can this vulnerability be exploited without authentication?
Yes, the vulnerability requires no authentication and no user interaction. An attacker with network access to the affected service can exploit it remotely by sending crafted requests, making it particularly dangerous for internet-facing or insufficiently firewalled deployments.
Is there active exploitation of CVE-2026-20045?
Yes, CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Organizations should treat patching as an urgent priority and investigate for signs of compromise.
What is the remediation deadline for federal agencies?
CISA has set a remediation deadline of February 11, 2026 for federal agencies under Binding Operational Directive 22-01. Private organizations are strongly encouraged to follow the same timeline.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.