{"id":"cisco-unified-communications-code-injection-jan-2026","category":"patch","status":"closed","title":"Cisco Unified Communications Manager flaw CVE-2026-20045 used in attacks; fixes available","tldr":"An exploited flaw can give attackers full control of Cisco business calling servers without logging in. Organisations using Unified CM, Unity Connection or Webex Calling Dedicated Instance should install Cisco’s fixes; release 12.5 needs migration.","summary":"CVE-2026-20045 affects Cisco’s business calling systems: Unified Communications Manager, its Session Management Edition and IM & Presence Service, Unity Connection and Webex Calling Dedicated Instance. A flaw in the web management interface lets a remote attacker run commands without signing in, then potentially gain full administrator access. Cisco disclosed it on 21 January, acknowledging exploitation attempts; CISA listed it as exploited that day. Cisco rates it critical, with a CVSS score of 8.2. Fixes include service updates and version-specific patches for releases 14 and 15. Release 12.5 requires migration, and there is no workaround. Cisco revised its patch-file listings in February; later Unity Connection 15SU4 documentation confirms the full update includes the fix. The reviewed sources do not identify victims, attackers or when attacks began, and provide no announcement that attacks have ended.","action":"If your workplace or family office uses these Cisco calling systems, ask its IT team or phone provider to confirm installation of the appropriate 14SU5 or 15SU4 update, or Cisco’s version-specific patch. Systems on release 12.5 must migrate to a fixed release.","product":"Cisco Unified Communications Manager, IM & Presence Service, Unity Connection and Webex Calling Dedicated Instance","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-20045"],"tags":["cisco","unified-cm","unity-connection","webex","code-injection","actively-exploited"],"affected":["Cisco Unified Communications Manager, Unified CM SME, Unified CM IM&P and Webex Calling Dedicated Instance: release 12.5; release 14 before 14SU5 and release 15 before 15SU4 unless the applicable Cisco patch is installed.","Cisco Unity Connection: release 12.5; release 14 before 14SU5 and release 15 before 15SU4 unless the applicable Cisco patch is installed.","Affected regardless of device configuration."],"fixed":["Unified CM, Unified CM SME, Unified CM IM&P and Webex Calling Dedicated Instance: 14SU5 or 15SU4.","Applicable version-specific patches for Unified CM products: ciscocm.CSCwr21851_Remote_Code_Execution_v1.zip; follow the included README.","Cisco Unity Connection: 14SU5 or 15SU4.","Applicable version-specific patches for Unity Connection: ciscocm.cuc.CSCwr29208_C0266-v2.zip; follow the included README.","Release 12.5: migrate to a fixed release."],"matches":[],"sources":[{"kind":"advisory","title":"Cisco Unified Communications Products Remote Code Execution Vulnerability","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-rce-mORhqY4b","by":"Cisco","date":"2026-02-13"},{"kind":"news","title":"Cisco fixes Unified Communications RCE zero day exploited in attacks","url":"https://www.bleepingcomputer.com/news/security/cisco-fixes-unified-communications-rce-zero-day-exploited-in-attacks/","by":"BleepingComputer","date":"2026-01-21"},{"kind":"news","title":"Cisco Fixes Actively Exploited Zero-Day CVE-2026-20045 in Unified CM and Webex","url":"https://thehackernews.com/2026/01/cisco-fixes-actively-exploited-zero-day.html","by":"The Hacker News","date":"2026-01-22"},{"kind":"advisory","title":"Cisco Releases Critical Security Update for Unified Communications Products","url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4738","by":"NHS England","date":"2026-01-22"},{"kind":"advisory","title":"Cisco security advisory (AV26-048)","url":"https://www.cyber.gc.ca/en/alerts-advisories/cisco-security-advisory-av26-048","by":"Canadian Centre for Cyber Security","date":"2026-01-22"},{"kind":"advisory","title":"Release Notes for Cisco Unity Connection Release 15 Service Update 4","url":"https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/connection/15/readme/b_15su4cucrn.html","by":"Cisco","date":"2026-06-08"}],"started":"2026-01-21","closed":"2026-06-08","created":"2026-11-03T22:36:25.415Z","updated":"2026-11-03T22:36:25.415Z","cve_notes":[{"cve":"CVE-2026-20045","name":"Code injection in Cisco calling management interfaces","what":"Insufficient checking of web requests in Cisco Unified Communications products lets a remote attacker run operating-system commands without logging in and potentially gain full administrator access.","severity":"critical","cvss":8.2}],"timeline":[{"at":"2026-06-08","added":"2026-11-03T22:23:31.291Z","kind":"other","text":"Cisco published Unity Connection 15SU4 release notes with download instructions and listed the associated defect, CSCwr29208, as resolved. This confirms the full service update was available by this date; interim patches had already been offered.","url":"https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/connection/15/readme/b_15su4cucrn.html","by":"Cisco","patch":null},{"at":"2026-02-13T15:21Z","added":"2026-11-03T22:23:31.291Z","kind":"vendor-revised","text":"Cisco revised the version-specific patch files listed in its advisory, including the Unity Connection C0266-v2 package. It did not describe the earlier fix as incomplete.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-rce-mORhqY4b","by":"Cisco","patch":null},{"at":"2026-01-21T16:00Z","added":"2026-11-03T22:23:31.291Z","kind":"disclosed","text":"Cisco disclosed CVE-2026-20045, released software fixes and reported attempted exploitation. The flaw allows remote commands without a login and can lead to full administrator access.","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-rce-mORhqY4b","by":"Cisco","patch":"patched"},{"at":"2026-01-21","added":"2026-11-03T22:23:31.291Z","kind":"cisa-added","text":"CISA added CVE-2026-20045 to its Known Exploited Vulnerabilities catalogue. US federal civilian agencies were given until 11 February to apply fixes.","url":"https://www.bleepingcomputer.com/news/security/cisco-fixes-unified-communications-rce-zero-day-exploited-in-attacks/","by":"BleepingComputer","patch":null}],"url":"https://hard.fyi/live/cisco-unified-communications-code-injection-jan-2026/","json":"https://hard.fyi/api/live?id=cisco-unified-communications-code-injection-jan-2026"}