CVE Tools
Track your stack

Cisco finally confirms attackers exploiting Unified CM flaw

BleepingComputerBy Sergiu Gatlan

Reported exploitedCisco Unified Communications Manager

Our summary

Cisco has confirmed that attackers are actively exploiting a Unified Communications Manager (Unified CM) vulnerability patched in early June: CVE-2026-20230. The issue is a remote, low-complexity server-side request forgery (SSRF) that can be abused by attackers without privileges via crafted HTTP requests, potentially leading to file-related impacts on affected systems. This matters because it indicates real-world compromise is underway, and Cisco recommends upgrading to fixed releases and using mitigations like disabling the vulnerable WebDialer service when updates can’t be applied immediately.

Read at BleepingComputer

BleepingComputer publishes this story on its own site; we link to it rather than reprint it.

  1. The Hacker NewsCisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes PublicCVE-2025-20309, CVE-2026-20045 +1
  2. BleepingComputerCisco warns of critical Unified CM flaw with PoC exploit codeCVE-2024-20253, CVE-2026-20045 +1
  3. Daily CyberSecurity (securityonline.info)CISA Adds Cisco Unified CM and PTC Windchill Flaws to KEV CatalogCVE-2025-20309, CVE-2026-20230
  4. SecurityWeekHackers Exploiting Cisco Unified CM VulnerabilityCVE-2026-20045, CVE-2026-20230
  5. SecurityWeekCisco Confirms In-the-Wild Exploitation of Unified CM VulnerabilityCVE-2026-20230
  6. Help Net SecurityWeek in review: Fortibleed campaign’s impact on orgs, Cisco Unified CM flaw exploitedCVE-2026-20230
  7. BleepingComputerCISA sets urgent deadline to fix Cisco flaw exploited in attacksCVE-2026-20230
  8. Dark ReadingIn Less Than 24 Hours, Attackers Weaponize Cisco CUCM FlawCVE-2026-20230
  9. SecurityWeekCisco SD-WAN Zero-Day Exploited Months Before PatchingCVE-2026-20230
  10. The Hacker NewsCisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to RootCVE-2026-20230

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store