Cisco Unified Communications Manager flaw CVE-2026-20045 used in attacks; fixes available
An exploited flaw can give attackers full control of Cisco business calling servers without logging in. Organisations using Unified CM, Unity Connection or Webex Calling Dedicated Instance should install Cisco’s fixes; release 12.5 needs migration.
If your workplace or family office uses these Cisco calling systems, ask its IT team or phone provider to confirm installation of the appropriate 14SU5 or 15SU4 update, or Cisco’s version-specific patch. Systems on release 12.5 must migrate to a fixed release.
What’s happening
CVE-2026-20045 affects Cisco’s business calling systems: Unified Communications Manager, its Session Management Edition and IM & Presence Service, Unity Connection and Webex Calling Dedicated Instance. A flaw in the web management interface lets a remote attacker run commands without signing in, then potentially gain full administrator access. Cisco disclosed it on 21 January, acknowledging exploitation attempts; CISA listed it as exploited that day. Cisco rates it critical, with a CVSS score of 8.2. Fixes include service updates and version-specific patches for releases 14 and 15. Release 12.5 requires migration, and there is no workaround. Cisco revised its patch-file listings in February; later Unity Connection 15SU4 documentation confirms the full update includes the fix. The reviewed sources do not identify victims, attackers or when attacks began, and provide no announcement that attacks have ended.
- What
- Flaw
- Affects
- Cisco Unified Communications Manager, IM & Presence Service, Unity Connection and Webex Calling Dedicated Instance
- Affected
- Cisco Unified Communications Manager, Unified CM SME, Unified CM IM&P and Webex Calling Dedicated Instance: release 12.5; release 14 before 14SU5 and release 15 before 15SU4 unless the applicable Cisco patch is installed.
Cisco Unity Connection: release 12.5; release 14 before 14SU5 and release 15 before 15SU4 unless the applicable Cisco patch is installed.
Affected regardless of device configuration. - Fixed in
- Unified CM, Unified CM SME, Unified CM IM&P and Webex Calling Dedicated Instance: 14SU5 or 15SU4.
Applicable version-specific patches for Unified CM products: ciscocm.CSCwr21851_Remote_Code_Execution_v1.zip; follow the included README.
Cisco Unity Connection: 14SU5 or 15SU4.
Applicable version-specific patches for Unity Connection: ciscocm.cuc.CSCwr29208_C0266-v2.zip; follow the included README.
Release 12.5: migrate to a fixed release. - Since
- 21 Jan 2026
- Closed
- 8 June 2026
Timeline
- Update
Cisco published Unity Connection 15SU4 release notes with download instructions and listed the associated defect, CSCwr29208, as resolved. This confirms the full service update was available by this date; interim patches had already been offered.
- Vendor revised
Cisco revised the version-specific patch files listed in its advisory, including the Unity Connection C0266-v2 package. It did not describe the earlier fix as incomplete.
- Made publicFixed
Cisco disclosed CVE-2026-20045, released software fixes and reported attempted exploitation. The flaw allows remote commands without a login and can lead to full administrator access.
- CISA added
CISA added CVE-2026-20045 to its Known Exploited Vulnerabilities catalogue. US federal civilian agencies were given until 11 February to apply fixes.
Sources
- Cisco Unified Communications Products Remote Code Execution VulnerabilityCisco · 13 Feb 2026
- Cisco fixes Unified Communications RCE zero day exploited in attacksBleepingComputer · 21 Jan 2026
- Cisco Fixes Actively Exploited Zero-Day CVE-2026-20045 in Unified CM and WebexThe Hacker News · 22 Jan 2026
- Cisco Releases Critical Security Update for Unified Communications ProductsNHS England · 22 Jan 2026
- Cisco security advisory (AV26-048)Canadian Centre for Cyber Security · 22 Jan 2026
- Release Notes for Cisco Unity Connection Release 15 Service Update 4Cisco · 8 June 2026