CVE-2026-20045

Think of this as a “remote keyboard” vulnerability in Cisco’s phone/voice management systems. An attacker can send specially made web requests to the server and cause it to run commands, potentially gaining full control. For a small business, that can mean your voice/communications system is compromised, stopped, or manipulated by an attacker.

This matters if your business runs or hosts Cisco Unified Communications systems such as Unified Communications Manager, Unified Communications Manager IM and Presence Service, Cisco Unity Connection, Unified Communications Manager SME, or Webex Calling Dedicated Instance.

The vulnerability does not require login or user interaction, so the key question is whether the affected web management interface is reachable from the network an attacker can reach (for example, over the internet or any exposed network path). If that management interface is reachable, you should assume it’s a real risk and act quickly.

RED. CISA added CVE-2026-20045 to its Known Exploited Vulnerabilities list, and exploitation has been reported, meaning attackers are actively targeting systems like these. Because the flaw allows remote command execution without authentication and can escalate to root, you should treat it as an urgent patching event.

Confirm whether we’re exposed

1. List every server/appliance in use that matches the affected product names: Cisco Unified Communications Manager, Cisco Unified Communications Manager IM and Presence Service, Cisco Unity Connection, Cisco Unified Communications Manager SME, and Webex Calling Dedicated Instance.
2. For each system, record the currently installed software version and build.
3. Confirm whether the web-based management interface for those systems is reachable from any network an attacker could access (internet-facing or routed through a firewall/VPN). Note: the findings state “authentication required: No,” and “user interaction: No,” so exposure depends mainly on network reachability.

Patch (target fixed version)

4. Upgrade all applicable components to the Cisco fixed release where provided:
   • Unified Communications Manager → 14su5
   • Unified Communications Manager IM and Presence Service → 14su5
   • Unity Connection → 14su5
5. If you manage multiple clusters or nodes, ensure every node has the updated software (attackers typically target the weakest or unpatched host).

Timing and requirements from CISA

6. Because this is on CISA KEV, prioritize completion by the CISA remediation due date: 2026-02-11.
7. If you cannot patch right away, Cisco guidance indicates you should apply mitigations per the vendor’s instructions; if mitigations are unavailable for your situation, the guidance says to discontinue use of the product.

Temporary mitigation (if patching is delayed)

8. Use the mitigations in the Cisco Security Advisory referenced in your vendor advisory link (and any BOD 22-01 guidance if relevant to cloud services in your environment).
9. As an immediate safety measure while waiting for upgrades, reduce/limit reachability to the web management interface (for example, block direct external access and restrict management access to approved networks). The goal is to remove network paths that allow remote attackers to send crafted HTTP requests.

After updating: what to watch

10. Review logs around the time window of the update for suspicious HTTP requests to the management interface.
11. Look for signs of post-exploitation such as unexpected file writes, unusual process execution, or configuration changes. (Field reporting notes file-write payloads in exploitation activity.)
12. Confirm that patch level and service health are stable after upgrade, and that all nodes match the expected versions.

Severity and status

• This is a High-severity Remote Code Execution issue (CVSS 8.2) with confirmed real-world exploitation (CISA KEV listed). The traffic-light verdict is RED.

Weakness and mechanism

• Weakness type: CWE-94 (Code Injection).
• Mechanism: improper validation of user-supplied input in HTTP requests to the web-based management interface. An attacker can send crafted HTTP requests to trigger arbitrary operating-system command execution, and successful exploitation may allow privilege escalation to root.

Attack vector and prerequisites

• Attack vector: network.
• Authentication required: No.
• User interaction: No.
• Therefore, exploitability primarily depends on whether the affected web management interface is reachable from the attacker’s network path.

Exploitation maturity

• Public exploit is available.
• Exploitation has been reported, and field observation includes file-write payload behavior using a PoC (noted by Defused).

KEV meaning

• “CISA KEV: YES” means it is a vulnerability that CISA considers actively exploited in the wild, which is why remediation is time-bound (CISA due date provided in the findings).