NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

Cisco Unified Communications Manager SSRF flaw CVE-2026-20230 exploited; fixes available

Attackers exploited Cisco’s business phone-system servers through CVE-2026-20230. Systems with WebDialer enabled are exposed. Ask IT to install 14SU6, 15SU5 or the applicable Cisco patch; disabling WebDialer is a temporary mitigation.

What to do

If your workplace uses Cisco Unified Communications Manager, ask its IT team to install 14SU6, 15SU5 or the version-specific COP patch Cisco specifies. Until patched, administrators can temporarily disable Cisco WebDialer Web Service under Cisco Unified Serviceability → Tools → Service Activation. Families do not need to update their phones for this server flaw.

What’s happening

CVE-2026-20230 affects Cisco Unified Communications Manager and its Session Management Edition when WebDialer is enabled. It lets a remote attacker who has not logged in make the server write files that could later enable full administrator access. Cisco disclosed it on 3 June. BleepingComputer reported observed exploitation on 23 June, CISA listed it on 25 June, and Cisco confirmed attacks in its 1 July advisory update. Fixes are available: 14SU6 for release 14, and 15SU5 or applicable version-specific COP patches for release 15. Cisco’s October release notes confirm 15SU5 is available despite the advisory retaining its September estimate. The reviewed sources do not establish whether attacks have stopped.

What
Flaw
Affects
Cisco Unified Communications Manager and Unified Communications Manager Session Management Edition
Affected
Cisco Unified Communications Manager release 14 before 14SU6, with WebDialer enabled
Cisco Unified Communications Manager release 15 before 15SU5 without the applicable COP patch, with WebDialer enabled
Cisco Unified Communications Manager Session Management Edition release 14 before 14SU6, with WebDialer enabled
Cisco Unified Communications Manager Session Management Edition release 15 before 15SU5 without the applicable COP patch, with WebDialer enabled
Fixed in
Cisco Unified CM and Unified CM SME 14SU6
Cisco Unified CM and Unified CM SME 15SU5
Cisco Unified CM and Unified CM SME release 15 with the applicable version-specific COP patch; consult its README
CVE
CVE-2026-20230
Since
3 June 2026
Closed
14 Oct 2026

Timeline

  1. New fixFixed

    Cisco published release notes for Unified Communications Manager 15SU5, build 15.0.1.15900-150. This is the release-15 update named in the SSRF advisory, which had previously listed a September target or version-specific COP patches.

  2. Vendor revised

    Cisco revised its advisory to confirm that it became aware of active exploitation in June. It again urged customers to install a fixed release.

  3. CISA added

    CISA added CVE-2026-20230 to its Known Exploited Vulnerabilities catalogue, according to the Canadian Centre for Cyber Security.

  4. Wider attacks

    BleepingComputer reported that Defused had observed exploitation over the preceding weekend. The observed activity appeared to be testing which servers were vulnerable.

  5. Made public

    Cisco disclosed CVE-2026-20230 and announced software fixes. Exploitation requires WebDialer to be enabled; it is disabled by default.

Sources

  1. Cisco Unified Communications Manager Server-Side Request Forgery VulnerabilityCisco · 1 July 2026
  2. Cisco Unified CM flaw CVE-2026-20230 now exploited in attacksBleepingComputer · 23 June 2026
  3. Cisco security advisory (AV26-547) – Update 1Canadian Centre for Cyber Security · 25 June 2026
  4. Release Notes for Cisco Unified Communications Manager and the IM and Presence Service Release 15SU5Cisco · 26 Oct 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from June 2026 · JSON · RSS