CVE-2026-20230
Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability
Description
CVE-2026-20230 is a HIGH-severity server-side request forgery (SSRF) vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME), carrying a CVSS 3.1 score of 8.6. The flaw arises from improper input validation of specific HTTP requests, allowing an unauthenticated, remote attacker to coerce an affected device into sending crafted requests and, ultimately, to write files to the underlying operating system that can be used to escalate to root. Although the CVSS base score is HIGH, Cisco has assigned this SSRF vulnerability a Security Impact Rating (SIR) of Critical precisely because a successful exploit can lead to root privileges on the appliance. CVE-2026-20230 is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and its EPSS score of 0.41694 (98.5th percentile) reflects a high likelihood of exploitation, making prompt remediation of Unified CM essential. Note that exploitation requires the WebDialer service to be enabled, which is not the default configuration.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | unified communications manager | >= 14.0, < 14su6; >= 15.0, <= 15su4a |
References
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW(Vendor Advisory)
- https://denizhalil.com/2026/06/12/cve-2026-20230-cisco-unified-cm-ssrf/(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20230(US Government Resource)
Weakness Type
CWE-918: Server-Side Request Forgery (SSRF)
CVE-2026-20230 stems from CWE-918, where Cisco Unified Communications Manager fetches or acts on a request without properly validating the user-supplied input in specific HTTP requests. This lets an attacker coerce the affected device into sending requests to unexpected destinations and write files onto the underlying operating system — turning an SSRF vulnerability into a foothold that can be leveraged to elevate privileges to root.
Learn more: CWE-918 — Server-Side Request Forgery (SSRF)
Impact Analysis
CVE-2026-20230 carries a CVSS 3.1 score of 8.6 (HIGH) and is remotely exploitable without physical access (Attack Vector NETWORK), easy to exploit with no special conditions (Attack Complexity LOW), requires no authentication (Privileges Required NONE), and needs no user interaction. The CVSS metrics record no direct confidentiality or availability impact (Confidentiality NONE, Availability NONE) but a HIGH integrity impact: the attacker can write files to the underlying operating system, tampering with the state of the Unified CM appliance. Because the scope is Changed, the impact can extend beyond the vulnerable web component to the underlying host — and Cisco warns that the file-write primitive can be used to escalate privileges to root, which is why Cisco rates the Security Impact as Critical despite the HIGH base score. With an EPSS score in the 98.5th percentile and confirmed active exploitation via the KEV listing, organizations running affected Unified CM or Unified CM SME versions with the WebDialer service enabled should treat this vulnerability as an urgent priority.
Exploit Maturity
Public exploit information is available for CVE-2026-20230 via denizhalil.com, which is tagged as an Exploit and third-party advisory in the references. CISA has confirmed active exploitation by adding CVE-2026-20230 to the Known Exploited Vulnerabilities catalog, with a federal remediation deadline of 2026-06-28; the KEV ransomware status is currently listed as Unknown. The EPSS score of 0.41694 places this vulnerability in the 98.5th percentile, indicating exploitation is far more likely than for the average CVE. Because a public exploit resource exists and the vulnerability is unauthenticated with a path to root, organizations with the WebDialer service enabled should assume exploitation attempts are ongoing and remediate immediately.
Remediation
- Apply the vendor fix per CISA's KEV required action. Apply mitigations in accordance with Cisco's instructions and comply with CISA's BOD 26-04 "Prioritizing Security Updates Based on Risk" guidance and "Forensics Triage Requirements"; follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. The federal remediation deadline was 2026-06-28.
- Upgrade to a fixed release. Affected releases are Unified CM/Unified CM SME 14.0 up to (but not including) 14SU6, and 15.0 up to and including 15SU4a. Upgrade to a fixed Cisco release as documented in the vendor advisory at sec.cloudapps.cisco.com.
- Disable WebDialer as an interim mitigation. Exploitation requires the WebDialer service to be enabled, and it is disabled by default. Where WebDialer is not required, confirm it is disabled to remove the attack surface until patching is complete.
- Restrict and monitor network access. Limit access to the Unified CM administrative and web interfaces to trusted management networks, and review HTTP request logs for anomalous or malformed requests to WebDialer endpoints and for unexpected file writes on the appliance.
- Harden against SSRF long-term. Following SSRF mitigation best practice, enforce strict validation and allowlisting of any request destinations and protocols, and block requests to internal and link-local address ranges so that untrusted input cannot redirect server-side requests.
Technical Details
CVE-2026-20230 is a server-side request forgery vulnerability in Cisco Unified Communications Manager that is triggered when the WebDialer service processes specific HTTP requests without adequately validating the supplied input. In an SSRF vulnerability of this class (CWE-918), the application can be coerced into issuing requests to destinations chosen by the attacker; here the flaw goes further, allowing the attacker to write files to the underlying operating system, which can subsequently be used to elevate privileges to root. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N shows the attack is network-borne, low-complexity, unauthenticated, and needs no user interaction, achieving a HIGH integrity impact with Changed scope while leaving confidentiality and availability directly unaffected. The Changed scope reflects that the SSRF and resulting file write cross from the vulnerable web service into the underlying host, which is the mechanism behind Cisco's Critical Security Impact Rating.
Frequently Asked Questions
Is CVE-2026-20230 being actively exploited?
Yes. CVE-2026-20230 is listed in CISA's Known Exploited Vulnerabilities catalog, confirming active exploitation, with a remediation deadline of 2026-06-28. A public exploit resource is also available via denizhalil.com, and the EPSS score of 0.41694 (98.5th percentile) indicates a high likelihood of exploitation. Ransomware involvement is currently listed as Unknown.
What products are affected by CVE-2026-20230?
The vulnerability affects Cisco Unified Communications Manager (Unified CM) and Unified Communications Manager Session Management Edition (Unified CM SME), specifically releases 14.0 up to (but not including) 14SU6 and 15.0 up to and including 15SU4a. Exploitation additionally requires the WebDialer service to be enabled, which is disabled in the default configuration.
How do I fix CVE-2026-20230?
Apply Cisco's fix per the vendor advisory and CISA's KEV required action, and upgrade Unified CM/Unified CM SME to a fixed release beyond the affected 14.0–14SU6 and 15.0–15SU4a ranges. As an interim mitigation, disable the WebDialer service where it is not required, restrict access to the administrative interfaces, and monitor for anomalous requests, as described in the Remediation section.
How severe is CVE-2026-20230?
CVE-2026-20230 is rated HIGH with a CVSS 3.1 score of 8.6, but Cisco has assigned it a Security Impact Rating of Critical because a successful exploit can escalate privileges to root. It is remotely exploitable without authentication or user interaction and yields a HIGH integrity impact (with no direct confidentiality or availability impact). Its inclusion in the KEV catalog and 98.5th-percentile EPSS score make it a high-priority vulnerability for immediate remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.