Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public

Cisco patched a critical SSRF vulnerability (CVE-2026-20230) in Unified Communications Manager allowing unauthenticated attackers to write files and escalate to root.

• •Server-side request forgery enables arbitrary file writes by bypassing HTTP request validation
• •Public exploit code accelerates timeline for real-world attacks
• •Vulnerability only affects WebDialer-enabled systems (disabled by default)
• •Fixes include 14SU6 upgrade for the 14 train; 15 train users need interim COP patches until September 2026 or must disable WebDialer
• •Unified CM has recurring critical unauthenticated vulnerabilities including hardcoded SSH credentials and RCE flaws

This summary was automatically generated by AI based on the original article and may not be fully accurate.