CVE-2026-20230: Cisco Unified CM SSRF to Root; Public PoC Out

Cisco Unified Communications Manager discloses CVSS 8.6 high-severity SSRF CVE-2026-20230. Unauthenticated attackers can write arbitrary files to the OS when WebDialer is enabled, then escalate to root. Public PoC is out. Cisco has not observed in-the-wild abuse; assess exposure now.

CVE-2026-20230 is a high-severity server-side request forgery (SSRF) in Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (Unified CM SME). CVSS v3.1 base score 8.6. Cisco marks impact Critical. Unauthenticated remote attackers send crafted HTTP requests to hosts with Cisco WebDialer Web Service enabled, write arbitrary files on the underlying OS, then escalate to root. No credentials required for system-level control.

Incident Overview

Cisco PSIRT disclosed the bug with public patches. Public PoC snippets appeared the same day. Cisco PSIRT reports no observed malicious exploitation, but PoC shortens attacker prep time. Only systems with WebDialer enabled are affected. WebDialer is off by default; deployments that enable it face highest risk. Unified CM is core enterprise voice/comms infrastructure: call routing, SIP signaling, Cisco collaboration suite integration. Compromise can mean service outage, toll fraud, voice-stream intercept, and lateral movement into the enterprise network.

Technical Details

Root cause: WebDialer Web Service HTTP handling lacks strict destination/URL validation. Attacker-crafted requests are proxied internally and trigger a file-write primitive. Pointing requests at attacker-controlled internal resources or privileged local write endpoints creates files at arbitrary paths; a follow-on privilege-escalation chain reaches root. Cisco scored CVSS 8.6 on unauthenticated network access plus file-write integrity impact; actual outcome is root takeover, so overall impact is Critical. After PoC publication, weaponizing the write primitive into a reliable exploit path typically takes hours.

Impact Assessment

CVSS: 8.6 (High). Low attack complexity, no privileges, no user interaction, remotely triggerable. Public PoC: yes. Known malicious use: none observed by Cisco at disclosure. Affected surface: all Unified CM 14.x, 15.x, and Unified CM SME with WebDialer enabled—core comms assets covering voice, call control, SIP routing, collaboration. Successful exploit yields system root; bypassing existing EDR and log collection is unlikely.

Affected Scope and Versions

• Cisco Unified CM Release 14: first fixed release 14SU6

• Cisco Unified CM Release 15: first fixed release 15SU5 (expected September 2026) or matching COP patch

• Cisco Unified CM SME: same as above

• Enablement condition: affected node must have Cisco WebDialer Web Service enabled

Remediation

• Inventory all Unified CM / Unified CM SME nodes: log in to Cisco Unified CM Administration, switch to Cisco Unified Serviceability, Tools → Control Center – Feature Services, locate Cisco WebDialer Web Service under CTI Services, confirm run state

• If enabled: upgrade to Release 14 14SU6 or Release 15 15SU5; if the patch is not yet out, apply the matching COP patch

• If WebDialer is unused: uncheck Cisco WebDialer Web Service under Tools → Service Activation and save; attack surface drops to zero

• Nodes that cannot patch yet: restrict Unified CM admin UI to trusted networks; firewall-block untrusted sources to WebDialer ports

• Review Unified CM web logs, proxy logs, firewall logs, IDS alerts, SIEM events; focus on anomalous HTTP to WebDialer endpoints

• Use supported admin and forensics tooling to check filesystem integrity on controlled hosts: unexpected new/modified files, unexpected config changes, suspicious outbound connections

• After patching: verify version, confirm service state, monitor application behavior, and review suspicious activity in the pre-patch window

Detection Rule References

• WebDialer service unexpectedly enabled (Sysmon / Cisco Unified Serviceability)

• Unusual HTTP request patterns against Unified CM ports 8000–9999

• Unexpected filesystem writes or executable drops on Unified CM nodes

• Anomalous outbound connections from Unified CM to internal management ports or unknown external IPs

Unified CM is core enterprise comms infrastructure. Patch in the next change window. Until then: network isolation, disable WebDialer, tighten logging.

References

• DEV Community: Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public

• IsItPatched: Recently patched software index

• ervik.as: Active Zero-Days 2026 Most Exploited Vulnerabilities