Summary
A high-severity server-side request forgery (SSRF) vulnerability in Cisco Unified Communications Manager (CUCM) and its Session Management Edition — tracked as CVE-2026-20230 (CVSS 8.6) — is now being actively exploited in the wild. Threat actors are using a publicly available proof-of-concept exploit to write arbitrary files to the underlying OS, drop webshells, and escalate privileges to root.
Cisco originally disclosed and patched the flaw on June 3, but active exploitation was confirmed on June 23-24 after attackers began probing internet-facing CUCM instances with the WebDialer service enabled. The WebDialer service, which provides click-to-call functionality, is disabled by default — but organizations that enabled it without patching are now exposed. Cisco has released fixes in Unified CM versions 14SU6 and 15SU5, and recommends disabling WebDialer as an immediate workaround.
Initial observed attacks appear to be focused on identifying vulnerable systems by writing test files, but the exploit chain trivially escalates to full root-level compromise once a foothold is established.
Source
Help Net Security · The Hacker News · BleepingComputer
Commentary
This is the second Cisco product actively exploited this month, following the Catalyst SD-WAN Manager flaw (CVE-2026-20262). The SSRF-to-root chain in CUCM is particularly nasty because Unified CM sits at the heart of enterprise voice infrastructure — an attacker with root on a call manager can intercept calls, pivot laterally, and cause significant operational damage.
The three-week gap between patch release and confirmed exploitation is a reminder that enterprise VoIP gear often lags behind on patching cycles. If you’re running CUCM with WebDialer enabled, patch or disable the service immediately — the PoC is public, and opportunistic scanning is already underway.