Hackers Exploit Critical Cisco Unified Communications Manager Vulnerability

Post Views: 39

Recent reports reveal active exploitation of a critical Cisco Unified CM vulnerability, prompting urgent security advisories.

Vulnerability Details

Cisco’s Unified Communications Manager (Unified CM) is under attack due to a recently addressed security flaw, CVE-2026-20230. The vulnerability allows unauthenticated remote attackers to execute server-side request forgery (SSRF) attacks, write arbitrary files to the OS, and escalate privileges to root. Cisco patched the flaw on June 3, but exploit activity has already been observed.

Exploitation Activity

Defused, an exploit intelligence firm, reported that the vulnerability is being actively exploited. The firm noted, “This is currently being exploited from a single source using an unvetted PoC, with genuinely-formatted file:// file-write payloads landing on our decoys.”

“This is currently being exploited from a single source using an unvetted PoC, with genuinely-formatted file:// file-write payloads landing on our decoys.”

Disclosure and Response

Cisco initially disclosed the fix but mentioned a public proof-of-concept (PoC) exploit existed without confirmed real-world attacks. SSD Secure Disclosure later released technical details and a PoC for remote code execution. Cisco has not yet verified the exploitation in its official advisory, and SecurityWeek has not received a response from the company.

Significance of Unified CM

Unified CM is Cisco’s core on-premises call control platform, critical for enterprise voice, video, and communications. Its widespread use makes CVE-2026-20230 a prime target for cybercriminals and state-sponsored actors.

Current Status and Recommendations

The vulnerability has not been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog. Enterprises are urged to apply patches, review configurations, and monitor for unusual file-write activities or unauthorized privilege escalations. Security teams should await further guidance from Cisco and cybersecurity agencies.

Broader Context

This marks the second Cisco Unified CM vulnerability exploited in 2026. The first, CVE-2026-20045, was a zero-day. Cisco’s SD-WAN products have also seen eight exploited vulnerabilities this year, highlighting the urgency for proactive security measures.