{"id":"cisco-unified-cm-ssrf-attacks-jun-2026","category":"patch","status":"closed","title":"Cisco Unified Communications Manager SSRF flaw CVE-2026-20230 exploited; fixes available","tldr":"Attackers exploited Cisco’s business phone-system servers through CVE-2026-20230. Systems with WebDialer enabled are exposed. Ask IT to install 14SU6, 15SU5 or the applicable Cisco patch; disabling WebDialer is a temporary mitigation.","summary":"CVE-2026-20230 affects Cisco Unified Communications Manager and its Session Management Edition when WebDialer is enabled. It lets a remote attacker who has not logged in make the server write files that could later enable full administrator access. Cisco disclosed it on 3 June. BleepingComputer reported observed exploitation on 23 June, CISA listed it on 25 June, and Cisco confirmed attacks in its 1 July advisory update. Fixes are available: 14SU6 for release 14, and 15SU5 or applicable version-specific COP patches for release 15. Cisco’s October release notes confirm 15SU5 is available despite the advisory retaining its September estimate. The reviewed sources do not establish whether attacks have stopped.","action":"If your workplace uses Cisco Unified Communications Manager, ask its IT team to install 14SU6, 15SU5 or the version-specific COP patch Cisco specifies. Until patched, administrators can temporarily disable Cisco WebDialer Web Service under Cisco Unified Serviceability → Tools → Service Activation. Families do not need to update their phones for this server flaw.","product":"Cisco Unified Communications Manager and Unified Communications Manager Session Management Edition","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-20230"],"tags":["cisco","unified-cm","ssrf","actively-exploited","business-phone-system"],"affected":["Cisco Unified Communications Manager release 14 before 14SU6, with WebDialer enabled","Cisco Unified Communications Manager release 15 before 15SU5 without the applicable COP patch, with WebDialer enabled","Cisco Unified Communications Manager Session Management Edition release 14 before 14SU6, with WebDialer enabled","Cisco Unified Communications Manager Session Management Edition release 15 before 15SU5 without the applicable COP patch, with WebDialer enabled"],"fixed":["Cisco Unified CM and Unified CM SME 14SU6","Cisco Unified CM and Unified CM SME 15SU5","Cisco Unified CM and Unified CM SME release 15 with the applicable version-specific COP patch; consult its README"],"matches":[],"sources":[{"kind":"advisory","title":"Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW","by":"Cisco","date":"2026-07-01"},{"kind":"news","title":"Cisco Unified CM flaw CVE-2026-20230 now exploited in attacks","url":"https://www.bleepingcomputer.com/news/security/cisco-unified-cm-sme-flaw-cve-2026-20230-now-exploited-in-attacks/","by":"BleepingComputer","date":"2026-06-23"},{"kind":"advisory","title":"Cisco security advisory (AV26-547) – Update 1","url":"https://www.cyber.gc.ca/en/alerts-advisories/cisco-security-advisory-av26-547","by":"Canadian Centre for Cyber Security","date":"2026-06-25"},{"kind":"advisory","title":"Release Notes for Cisco Unified Communications Manager and the IM and Presence Service Release 15SU5","url":"https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/rel_notes/15/SU5/cucm_b_release-notes-for-cucm-imp-15su5.html","by":"Cisco","date":"2026-10-26"}],"started":"2026-06-03","closed":"2026-10-14","created":"2026-11-03T22:18:16.011Z","updated":"2026-11-03T22:18:16.011Z","cve_notes":[{"cve":"CVE-2026-20230","name":"SSRF and file writing in Cisco Unified CM WebDialer","what":"Insufficient checking of web requests in Unified CM and Unified CM SME with WebDialer enabled lets an unauthenticated remote attacker write operating-system files that could later enable root access.","severity":"critical","cvss":8.6}],"timeline":[{"at":"2026-10-14","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"Cisco published release notes for Unified Communications Manager 15SU5, build 15.0.1.15900-150. This is the release-15 update named in the SSRF advisory, which had previously listed a September target or version-specific COP patches.","url":"https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/rel_notes/15/SU5/cucm_b_release-notes-for-cucm-imp-15su5.html","by":"Cisco","patch":"patched"},{"at":"2026-07-01T15:10Z","added":"2026-11-03T22:11:23.504Z","kind":"vendor-revised","text":"Cisco revised its advisory to confirm that it became aware of active exploitation in June. It again urged customers to install a fixed release.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW","by":"Cisco","patch":null},{"at":"2026-06-25","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-20230 to its Known Exploited Vulnerabilities catalogue, according to the Canadian Centre for Cyber Security.","url":"https://www.cyber.gc.ca/en/alerts-advisories/cisco-security-advisory-av26-547","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2026-06-23","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"BleepingComputer reported that Defused had observed exploitation over the preceding weekend. The observed activity appeared to be testing which servers were vulnerable.","url":"https://www.bleepingcomputer.com/news/security/cisco-unified-cm-sme-flaw-cve-2026-20230-now-exploited-in-attacks/","by":"BleepingComputer","patch":null},{"at":"2026-06-03T16:00Z","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Cisco disclosed CVE-2026-20230 and announced software fixes. Exploitation requires WebDialer to be enabled; it is disabled by default.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW","by":"Cisco","patch":null}],"url":"https://hard.fyi/live/cisco-unified-cm-ssrf-attacks-jun-2026/","json":"https://hard.fyi/api/live?id=cisco-unified-cm-ssrf-attacks-jun-2026"}