CVE-2026-20230Active Exploitation(cisco / unified_communications_manager)

CRITICALCVSS 8.6 · HIGHCISA KEV

Exploitation observed; activity peaked at 41 mentions and remains active

Immediate actions

Patch cisco unified_communications_manager systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root. Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root. Note: To exploit this vulnerability, the WebDialer service must be enabled. WebDialer is disabled by default.

cisco CVEs Back to dashboard

9.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-06-28. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Exploit / PoC references

https://denizhalil.com/2026/06/12/cve-2026-20230-cisco-unified-cm-ssrf/

Vendor / third-party advisories

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20230

Weakness type (CWE)

CWE-918

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

unified_communications_manager

Threat summary

Active exploitation appears in 102 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
223 mentions across 34 observed days

What's happening

Active exploitation reported across 102 signals
Exploit tool or code specified in 31 signals
PoC mentioned or linked in 87 signals
Patch or workaround mentioned in 108 signals
Technical details provided in 139 signals
Disclosure: 30 classified signals
Peaked 18d ago at 41 mentions (2026-06-24); latest day: 1
223 total mentions across 34 days

Affected systems

Vendors

cisco

Products

unified_communications_manager

Deep dive

Activity timeline223 mentions / 34d

Signal classification6 categories

Active Exploitation

9844.1%

Patch

4319.4%

Disclosure

3013.5%

PoC

2511.3%

Exploit

135.9%

General

135.9%

Referenced assets135 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-03	2	Disclosure1PoC1
2026-06-04	37	Active Exploitation1Disclosure2Exploit7General1Patch18PoC8
2026-06-05	20	Active Exploitation1Disclosure2Exploit2General1Patch9PoC5
2026-06-06	7	Disclosure3Exploit1General1PoC2
2026-06-08	4	Disclosure3Patch1
2026-06-09	3	Disclosure2Patch1
2026-06-10	1	General1
2026-06-11	1	PoC1
2026-06-13	1	PoC1
2026-06-14	1	Exploit1
2026-06-15	2	Exploit1General1
2026-06-18	1	Patch1
2026-06-20	1	Disclosure1
2026-06-22	1	Active Exploitation1
2026-06-23	11	Active Exploitation10Disclosure1
2026-06-24	41	Active Exploitation35Disclosure1General1Patch3PoC1
2026-06-25	15	Active Exploitation11Disclosure1Patch2PoC1
2026-06-26	16	Active Exploitation11Disclosure2General1Patch1PoC1
2026-06-27	7	Active Exploitation2Disclosure3General1Patch1
2026-06-28	4	Active Exploitation3Disclosure1
2026-06-29	4	Active Exploitation4
2026-06-30	4	Active Exploitation2Disclosure1Patch1
2026-07-01	4	Active Exploitation2Disclosure2
2026-07-02	7	Active Exploitation4Exploit1Patch2
2026-07-03	1	Active Exploitation1
2026-07-04	1	Active Exploitation1
2026-07-05	3	Active Exploitation2Disclosure1
2026-07-06	1	Patch1
2026-07-13	3	Disclosure1General2
2026-07-14	2	Patch2
2026-07-16	8	Active Exploitation7Disclosure1
2026-07-17	7	Disclosure1General2PoC4
2026-08-13	1	General1

Full discourse20 posts

The Hacker News@TheHackersNews136d
Patch
🚨 No auth required ... a crafted web request to Cisco Unified CM can write files to the OS and open a path to root. CVE-2026-20230 patch is out, PoC exploit is public, and no attacks yet. Only bites if WebDialer is ON. Fix: 14SU6 / COP / 15SU5, or kill WebDialer. Read: https://thehackernews.com/2026/06/cisco-patches-cve-2026-20230-in-unified.html
Post summary
Cisco has released a patch for CVE-2026-20230, a PoC is publicly available, but no real‑world exploitation has been observed; the fix can be applied via updates or disabling WebDialer.
4252741025.1K
2.0M followersView on X
Defused@DefusedCyber118d
Active Exploitation
🚨 Over the weekend we observed exploitation of CVE-2026-20230 - Cisco Unified CM (CUCM) WebDialer SSRF → root file-write (CVSS 8.6) No previously recorded exploitation, and not yet listed in CISA KEV. This is currently being exploited from a single source using an unvetted PoC, with genuinely-formatted file:// file-write payloads landing on our decoys. Track Cisco CUCM exploitation 👉 http://console.defusedcyber.com/signup
Post summary
The post reports active exploitation of CVE-2026-20230 on Cisco CUCM via a web-based SSRF, with file‑write attacks observed from a single source using an unvetted PoC. No patch or fix is mentioned.
1214571919.1K
7.6K followersView on X
YogSotho@YogSoth0120d
Disclosure
🚨 # CVE-2026-20230 Cisco Unified CM Exploit Kit 🔥 **CVE-2026-20230 — Cisco Unified Communications Manager SSRF + File Write 🌐 **Multi-Stage RCE Chain with Webshell Deployment 🧠 CVE-2026-20230 is a critical vulnerability in Cisco Unified Communications Manager (CUCM) affecting the Webdialer service. The vulnerability allows unauthenticated attackers to perform Server-Side Request Forgery (#SSRF) and arbitrary file write, leading to full remote code execution. #exploit #0days #security #hacking #CVE #CVSS #RCE #Cisco #unleaked
Post summary
The tweet announces a critical vulnerability in Cisco Unified Communications Manager that permits unauthenticated SSRF and arbitrary file writes, enabling full remote code execution.
312056172.4K
1.8K followersView on X
The Hacker News@TheHackersNews116d
Active Exploitation
🛑 Cisco Unified CM admins should check WebDialer now. CVE-2026-20230 is being exploited, and vulnerable WebDialer-enabled systems can be abused by unauthenticated attackers to write files. Cisco patched it in 14SU6 and 15SU5. Read: https://thehackernews.com/2026/06/cisco-unified-cm-flaw-exploited-after.html
Post summary
CVE‑2026‑20230 is actively exploited in the wild, enabling unauthenticated attackers to write files on Cisco Unified CM WebDialer systems; Cisco has released patches (14SU6, 15SU5).
217252522.0K
2.2M followersView on X
The Hacker News@TheHackersNews114d
Active Exploitation
CISA just added a Cisco Unified CM flaw to its exploited bugs list. Defused Cyber says CVE-2026-20230 is being exploited from a single source using an unvetted PoC. The bug can allow unauthenticated SSRF and file writes when WebDialer is enabled. The technical trail is here: https://thehackernews.com/2026/06/cisco-unified-cm-flaw-exploited-after.html
Post summary
CISA has listed CVE-2026-20230 as an actively exploited vulnerability; Defused Cyber reports a single source exploiting it via an unvetted PoC, with the flaw allowing unauthenticated SSRF and file writes when WebDialer is enabled.
311043620.4K
2.2M followersView on X
ボス@サイバーセキュリティの専門家@boss_sec_labo116d
Patch
通信・開発・認証。企業ITを支える三本柱に、今日三本同時に穴が空いた。 CiscoのSSRF脆弱性、CI/CDの設計欠陥、ManageEngineのSSO認証回避。「まさかそこが」という場所から攻撃者は入ってくる。そこが狙い目だからだ。・CiscoUCM CVE-2026-20230、SSRFでWebシェル投下・root権限奪取・「Cordyceps」CI/CD脆弱性、GitHub上3万超リポジトリで無認証コード改ざん可能・ManageEngine CVE-2026-11374、CVSS9.0のSSO認証回避・アカウント乗っ取りパッチは三件全部出ている。問題は適用済みかどうかだ。今すぐ担当者に確認しろ。「対応中」という返答では終わらせるな。完了期限を日付で取れ。君の現場で「完了」と言い切れる根拠は何だ？
Post summary
The post highlights the release of patches for three CVEs, emphasizing the need for immediate verification of patch status in affected environments.
04136142.3K
1.5K followersView on X
Defused@DefusedCyber116d
Active Exploitation
🚨 CVE-2026-20230 (Cisco CUCM WebDialer SSRF → RCE, CVSS 8.6) is now being exploited full-chain. Our honeypots are seeing automated sweeps dropping webshells, all via Tor. Track Cisco CUCM exploitation 👉 https://console.defusedcyber.com/signup https://t.co/M0xnOEX52L
Post summary
CVE‑2026‑20230 is actively exploited in the wild, with honeypot data showing automated sweeps that drop webshells via Tor, confirming real‑world usage.
311131912.2K
7.6K followersView on X
BleepingComputer@BleepinComputer117d
Active Exploitation
Cisco Unified CM SME flaw CVE-2026-20230 now exploited in attacks https://www.bleepingcomputer.com/news/security/cisco-unified-cm-sme-flaw-cve-2026-20230-now-exploited-in-attacks/ https://www.bleepingcomputer.com/news/security/cisco-unified-cm-sme-flaw-cve-2026-20230-now-exploited-in-attacks/
Post summary
The post announces that CVE-2026-20230 is currently being exploited in real-world attacks, but offers no PoC, exploit details, or patch information.
217033211.5K
256.6K followersView on X
CISA Cyber@CISACyber115d
Patch
🛡️ ️We added PTC Windchill & FlexPLM improper input validation vulnerability CVE-2026-12569 and Cisco Unified Communications Manager vulnerability CVE-2026-20230 to our Catalog. Visit https://go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. https://t.co/q33CcWUk6w
Post summary
The tweet announces that two CVEs have been added to the DHS catalog and encourages applying mitigations, but provides no PoC, exploit, or detailed technical information.
41113248.8K
301.2K followersView on X
Nicolas Krassas@Dinosn97d
Disclosure
Cisco Unified CM Pre-Auth RCE — When the Phone System Becomes the Attacker’s Foothold https://blog.securelayer7.net/cve-2026-20230-cisco-unified-cm-rce/
Post summary
The text announces a newly disclosed pre-authorization remote code execution vulnerability (CVE-2026-20230) in Cisco Unified CM, but does not provide exploit code, patch information, or active exploitation evidence.
11312864.8K
160.8K followersView on X
Dark Web Informer@DarkWebInformer136d
Disclosure
‼️ SSRF to Root: Unauthenticated File-Write Flaw in Cisco Unified CM (CVE-2026-20230) https://darkwebinformer.com/ssrf-to-root-unauthenticated-file-write-flaw-in-cisco-unified-cm-cve-2026-20230
Post summary
The post announces an unauthenticated file-write flaw (CVE-2026-20230) in Cisco Unified CM, describing SSRF to root-level access, but does not provide PoC, exploit, patch, or active exploitation details.
07122614.4K
223.8K followersView on X
Ryan Dewhurst@ethicalhack3r114d
Active Exploitation
Threat actor malware observed following CVE-2026-20230 exploitation. KEVIntel has identified a payload being downloaded during exploitation of Cisco Unified Communications Manager SSRF: Binary: gpg-bus Install path: ~/.local/.agent/ MD5: f96d3df92d9dd8651d0314c9742f5252 At time of posting, only 1 VirusTotal engine (Microsoft) detects the sample.
Post summary
The post reports real-world exploitation of CVE-2026-20230 (an SSRF in Cisco Unified Communications Manager) by a threat actor who deployed a "gpg-bus" payload; no patch or exploit code details are provided.
1801461.4K
21.2K followersView on X
ZoomEye@zoomeye_team114d
General
🚨 CVE-2026-20230: Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition Server-Side Request Forgery (SSRF) Critical Vulnerability Alert! Cisco Unified Communications Manager is affected by CVE-2026-20230. Full Vulnerability Details & Analysis at DarkEye: 🔗 https://darkeye.org/vuln/cve/CVE-2026-20230 🔍 Identify Targets via ZoomEye: Filter: vul.cve="CVE-2026-20230" Search Dork: app="Cisco Unified Communications Manager" Exposure: 5k instances identified globally. ZoomEye Search Link: 👉 https://www.zoomeye.ai/searchResult?q=YXBwPSJDaXNjbyBVbmlmaWVkIENvbW11bmljYXRpb25zIE1hbmFnZXIi&t=all&utm_source=twitter&utm_medium=social&utm_campaign=cve_ops_20260626 #Infosec #CyberSecurity #ZoomEye #DarkEye
Post summary
The tweet announces a critical SSRF vulnerability (CVE-2026-20230) in Cisco Unified Communications Manager, linking to DarkEye for details and ZoomEye for target discovery, but does not provide PoC, exploit code, active exploitation evidence, patches, or false-positive claims.
3401753.3K
12.6K followersView on X
YogSotho@YogSoth0127d
Exploit
New exploits: **predator_w6x_upgraded.zip** | CVE-49195, CVE-49196, CVE-49199 **tenda_cx12l_upgraded.zip** | CVE-2026-11503, CVE-2026-11504 **tenda_f451_upgraded.zip** | CVE-2026-11556, CVE-2026-11557 **cisco_20230_upgraded.zip** | CVE-2026-20230 **tplink_archer_20269151_upgraded.zip** | CVE-2026-9151 #exploit #0days #CVE #CVSS #security #hacking
Post summary
The post announces new exploit packages for several CVEs, confirming availability of functional exploit code without evidence of active attacks or mitigations.
111187769
1.8K followersView on X
dbugs@ptdbugs114d
PoC
🔔 A PoC/exploit has been discovered for vulnerability CVE-2026-20230 PT ID: PT-2026-45987 Vendor: Cisco Product: Cisco Unified Communications Manager Description: A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root. Link: https://github.com/W5M1n9/Cisco-Unified-Communications-Manager-Server-Side-Forgery-Request-Vulnerability-CVE-2026-20230 #dbugs_vuln
Post summary
A PoC for CVE‑2026‑20230 has been released, detailing an SSRF vulnerability in Cisco Unified Communications Manager that allows unauthenticated file writes, with no indication of active exploitation or patches.
0101271.1K
3.0K followersView on X
Horizon3.ai@Horizon3ai115d
PoC
🚨 An SSRF on a communications platform isn't just an SSRF. It can become root. Rapid Response test now available for Cisco Unified CM CVE-2026-20230. https://t.co/YmaNNhNVv2
Post summary
A Rapid Response test has been made available for Cisco Unified CM CVE-2026-20230, indicating that a proof of concept for the SSRF that can lead to root is available, though no exploit tool or active exploitation evidence is referenced.
15093660
2.9K followersView on X
Junaid@whosjunaidd110d
Active Exploitation
This month, attackers started getting root on Cisco phone systems over the internet, no login needed, by abusing the web service behind the "click to dial" button (CVE-2026-20230) The whole break-in starts with tricking that dialer into writing one file to disk
Post summary
The post reports that attackers are actively exploiting CVE-2026-20230 to gain root access on Cisco phone systems via the web service behind the "click to dial" button.
2001301.7K
880 followersView on X
yousukezan@yousukezan136d
Exploit
Cisco Unified Communications Managerに見つかった深刻な脆弱性の概念実証コード（PoC）も公開された。未認証の攻撃者がシステムへ不正なファイルを書き込み、最終的にroot権限を取得できる恐れがある。 CVE-2026-20230は、Cisco Unified CMおよびSession Management Editionに存在するサーバーサイドリクエストフォージェリ（SSRF）の脆弱性だ。不正なHTTPリクエストを送ることでOS上へ任意ファイルを書き込める。Ciscoによると、このファイルを足掛かりに権限昇格が可能となり、システムの完全な制御につながる可能性がある。攻撃が成立するのはWebDialerサービスが有効な環境に限られる。この機能は初期設定では無効だが、有効化している環境は影響を受ける。現時点で実際の悪用は確認されていないものの、PoCが公開されたことで攻撃リスクは高まっている。 CiscoはCVE-2026-20230の修正版を提供しており、14系は14SU6、15系は15SU5または暫定COPパッチへの更新を推奨している。アップデートできない場合は、WebDialerサービスを無効化することが有効な緩和策となる。 Ciscoの音声関連製品では近年も深刻な脆弱性が相次いでおり、2025年にはハードコードされたrootアカウント、2026年初頭には実際に悪用された未認証RCE脆弱性が修正されている。 https://thehackernews.com/2026/06/cisco-patches-cve-2026-20230-in-unified.html
Post summary
The article announces a PoC for CVE-2026-20230, detailing its SSRF nature and potential for root escalation, while highlighting Cisco’s patch releases and mitigations.
040552.2K
14.5K followersView on X
piyokango@piyokango115d
Active Exploitation
米国CISAが悪用を確認した脆弱性 #KEV をカタログに追加しました。（6/25追加） 🛡CVE-2026-12569 ✅概要・深刻度：緊急 9.3 (CVSS Base) / PTC (CNA) ・種別：不適切な入力確認 (CWE-20) / 信頼できないデータのデシリアライゼーション (CWE-502) ・CVSS:CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:U/V:C/U:Red PTC Windchill PDMLink および PTC FlexPLM に存在するリモートコード実行の脆弱性です。信頼できないデータのデシリアライゼーションを通じて悪用される可能性があります。本脆弱性は、すべての CPS バージョン、および Windchill / FlexPLM 11.0 M030 以前のリリースにも影響します。 ✅ChatGPTによる脆弱性評価・国内影響度：中・悪用難易度：低 ✅CISA 評価・攻撃自動化：自動化は可能・技術的影響：完全制御 ✅攻撃前提条件・PTC Windchill PDMLink または PTC FlexPLM を使用している・影響を受けるバージョンまたは CPS を使用している・攻撃者が対象環境へネットワーク経由でアクセスできる・攻撃者は認証情報を必要としない・PTC が提供する修正パッチまたは緩和策が適用されていない ✅悪用時影響・リモートコード実行につながる可能性がある・Windchill login ディレクトリ配下に JSP Web シェルを設置される可能性がある・不正なコマンド実行やファイル一覧取得に悪用される可能性がある・製品データや業務データへ不正アクセスされる可能性がある・機密性、完全性、可用性に高い影響が生じる ✅悪用事例等に関する公開情報・PoC/Exploit：一部公開（技術情報のみ）・ITW：確認済み（PTC） PTC は、CVE-2026-12569 に関連して継続的な脅威活動を受けていると公表。 ✅関連情報・https://nvd.nist.gov/vuln/detail/CVE-2026-12569 ・https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability ・https://www.ptc.com/en/support/article/CS473270 ・https://github.com/cisagov/vulnrichment/blob/develop/2026/12xxx/CVE-2026-12569.json ・https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-12569 🛡CVE-2026-20230 Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability ✅概要・深刻度：重要 8.6 (CVSS Base) / Cisco Systems, Inc. (CNA) ・種別：サーバサイドのリクエストフォージェリ (CWE-918) ・CVSS:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N Cisco Unified Communications Manager および Cisco Unified Communications Manager Session Management Edition に存在する SSRF の脆弱性です。 WebDialer サービスが有効な構成で、未認証のリモート攻撃者が細工した HTTP リクエストを送信することで悪用できる可能性があります。 ✅ChatGPTによる脆弱性評価・国内影響度：高・悪用難易度：中 ✅CISA 評価・攻撃自動化：自動化は困難・技術的影響：完全制御 ✅攻撃前提条件・Cisco Unified Communications Manager または Unified CM SME を使用している・WebDialer サービスが有効である・攻撃者が対象機器へネットワーク経由でアクセスできる・攻撃者は認証情報を必要としない・修正済みソフトウェアまたは Cisco 提供の修正が適用されていない ✅悪用時影響・SSRF により内部サービスへ不正アクセスされる可能性がある・基盤 OS 上へファイルを書き込まれる可能性がある・書き込まれたファイルを後続の root 権限昇格に利用される可能性がある・Unified CM 環境を侵害される可能性がある・音声・通信基盤の完全性に高い影響が生じる ✅悪用事例等に関する公開情報・PoC/Exploit：一部公開（技術情報のみ）・ITW：確認済み（Defused） Defused は、CVE-2026-20230 の悪用試行を観測し、WebDialer コンポーネントに対する file:// URI ペイロードにより /tmp/cve-2026-20230-test.txt のようなテストファイルを書き込む偵察活動を確認したと報告。 ✅関連情報・https://nvd.nist.gov/vuln/detail/CVE-2026-20230 ・https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW ・https://github.com/cisagov/vulnrichment/blob/develop/2026/20xxx/CVE-2026-20230.json ・https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20230 ・https://denizhalil.com/2026/06/12/cve-2026-20230-cisco-unified-cm-ssrf/ ・https://www.kital.com.ph/cisco-unified-communications-vulnerability-reconnaissance/ https://www.cisa.gov/news-events/alerts/2026/06/25/cisa-adds-two-known-exploited-vulnerabilities-catalog #vulnerability
Post summary
Both CVE-2026-12569 and CVE-2026-20230 are confirmed to be actively exploited, with detailed technical data and vendor mitigation references provided.
0001116.9K
44.1K followersView on X
Daily CyberSecurity@the_yellow_fall112d
Active Exploitation
Attackers exploit a Cisco Unified CM RCE flaw (CVE-2026-20230) in the wild. Public PoC code now details the SSRF-to-root chain. Patch now. #Cisco #CUCM #CVE202620230 #SSRF #RCE #CyberSecurity https://securityonline.info/cisco-unified-cm-rce-cve-2026-20230 https://t.co/1NZ8KtjLpr
Post summary
Cisco Unified CM RCE (CVE-2026-20230) is actively being exploited in the wild with a publicly available SSRF-to-root PoC, and a patch has been released.
11081995
12.9K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	cisco	unified_communications_manager	-	-	-
App	cisco	unified_communications_manager	-	-	-

Explore more

Back to dashboard cisco CVEs unified_communications_manager vulnerabilities

What researchers are saying

CVE-2026-20230

YogSotho[verified]@YogSoth0Disclosure

The tweet announces a critical vulnerability in Cisco Unified Communications Manager that permits unauthenticated SSRF and arbitrary file writes, enabling full remote code execution.

ボス@サイバーセキュリティの専門家[verified]@boss_sec_laboPatch

The post highlights the release of patches for three CVEs, emphasizing the need for immediate verification of patch status in affected environments.

BleepingComputer[verified]@BleepinComputerActive Exploitation

The post announces that CVE-2026-20230 is currently being exploited in real-world attacks, but offers no PoC, exploit details, or patch information.

Nicolas Krassas[verified]@DinosnDisclosure

The text announces a newly disclosed pre-authorization remote code execution vulnerability (CVE-2026-20230) in Cisco Unified CM, but does not provide exploit code, patch information, or active exploitation evidence.

Ryan Dewhurst[verified]@ethicalhack3rActive Exploitation

The post reports real-world exploitation of CVE-2026-20230 (an SSRF in Cisco Unified Communications Manager) by a threat actor who deployed a "gpg-bus" payload; no patch or exploit code details are provided.

ZoomEye[verified]@zoomeye_teamGeneral

The tweet announces a critical SSRF vulnerability (CVE-2026-20230) in Cisco Unified Communications Manager, linking to DarkEye for details and ZoomEye for target discovery, but does not provide PoC, exploit code, active exploitation evidence, patches, or false-positive claims.

YogSotho[verified]@YogSoth0Exploit

The post announces new exploit packages for several CVEs, confirming availability of functional exploit code without evidence of active attacks or mitigations.

dbugs[verified]@ptdbugsPoC

A PoC for CVE‑2026‑20230 has been released, detailing an SSRF vulnerability in Cisco Unified Communications Manager that allows unauthenticated file writes, with no indication of active exploitation or patches.