Cisco has disclosed a high-severity server-side request forgery (SSRF) vulnerability in Unified Communications Manager (Unified CM) and Unified CM Session Management Edition that can be escalated to root-level privilege. Tracked as CVE-2026-20230 with a CVSS score of 8.6, the flaw was published on June 3, 2026 — and proof-of-concept exploit code is already publicly available.
The vulnerability exists in the WebDialer service component due to improper input validation for specific HTTP requests. An unauthenticated, remote attacker can send a crafted HTTP request to write files to the underlying operating system, then leverage that capability to escalate privileges to root. The WebDialer service is disabled by default, but organizations that have enabled it are immediately at risk.
Cisco has released patches in Unified CM version 14SU6, with a fix for version 15SU5 expected in September 2026 (a COP1 patch is available as an interim measure). As of June 4, there is no evidence of active exploitation in the wild, but the availability of public PoC code makes exploitation imminent.
Source
Coverage: Cisco Advisory · SecurityWeek · BleepingComputer
Commentary
Unified Communications Manager is a backbone of enterprise telephony — it handles call routing, video conferencing, and messaging for large organizations worldwide. A root-level compromise of this system could give attackers access to call metadata, voicemail, and potentially the ability to intercept or redirect calls.
The saving grace is that WebDialer is disabled by default. But enterprises that enabled it for click-to-call functionality need to treat this as an emergency. Public PoC code plus unauthenticated remote access plus root escalation is the kind of trifecta that gets exploited fast. If you are running Cisco Unified CM with WebDialer enabled, patch today or disable the service immediately.