CVE-2026-20230 is a server-side request forgery (SSRF) vulnerability in Cisco Unified Communications Manager that allows unauthenticated remote attackers to send crafted HTTP requests to exploit the system. Cisco patched this vulnerability in early June 2026 with fixed releases 14SU6 and 15SU5. Initially, Cisco was aware of public proof-of-concept exploit code but had no evidence of active exploitation. However, by late June 2026, threat actors began actively exploiting the flaw, using file:// payloads to create files on affected devices. Cisco confirmed ongoing exploitation and strongly recommends upgrading to patched versions. For environments unable to patch immediately, Cisco advises disabling the WebDialer service to block attacks. Shadowserver reports over 200 exposed Unified CM instances online, primarily in Asia and North America. This vulnerability adds to a series of recent critical flaws in Unified CM actively exploited in the wild.

The vulnerability enables unauthenticated remote attackers to perform SSRF attacks against Cisco Unified CM, potentially allowing them to create files on the targeted system. This could lead to unauthorized system manipulation or further compromise. Active exploitation has been confirmed, increasing the risk to organizations running vulnerable versions of Unified CM. The exposure of over 200 instances online increases the attack surface. The impact is significant given Unified CM's role in managing IP telephony and call routing infrastructure.

Cisco has released official patches in Unified CM versions 14SU6 and 15SU5 (September 2026 or COP) that fully remediate CVE-2026-20230. Customers are strongly urged to upgrade to these fixed releases as soon as possible. For those unable to patch immediately, Cisco recommends disabling the vulnerable WebDialer service to block incoming exploitation attempts. Monitor vendor advisories for updates and apply patches promptly to prevent ongoing exploitation.