CVE-2026-20230

Analyzed Analyzed - Analysis Complete

Server-Side Request Forgery in Cisco Unified Communications Manager

Publication date: 2026-06-03

Last updated on: 2026-07-01

Assigner: Cisco Systems, Inc.

Description

A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root. Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root. Note: To exploit this vulnerability, the WebDialer service must be enabled. WebDialer is disabled by default.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-03

Last Modified

2026-07-01

Generated

2026-07-14

AI Q&A

2026-06-03

EPSS Evaluated

2026-07-12

NVD

CVE-2026-20230

EUVD

EUVD-2026-34137

Affected Vendors & Products

Vendor	Product	Version / Range
cisco	unified_communications_manager	From 14.0 (inc) to 14su6 (exc)
cisco	unified_communications_manager	From 15.0 (inc) to 15su4a (inc)
cisco	unified_communications_manager	From 14.0 (inc) to 14su6 (exc)
cisco	unified_communications_manager	From 15.0 (inc) to 15su4a (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

CVE-2026-20230 is a critical server-side request forgery (SSRF) vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME).

The vulnerability arises from improper input validation of specific HTTP requests, which allows an unauthenticated, remote attacker to send crafted HTTP requests to an affected device.

If successfully exploited, the attacker could write files to the underlying operating system, potentially leading to privilege escalation to root access.

Exploitation requires the WebDialer service to be enabled, which is disabled by default.

Impact Analysis

This vulnerability can have a critical impact because it allows an unauthenticated attacker to remotely execute server-side request forgery attacks.

A successful exploit could enable the attacker to write files to the operating system and escalate privileges to root, giving them full control over the affected device.

Such control could lead to unauthorized access, manipulation, or disruption of communications managed by Cisco Unified CM or Unified CM SME.

Since the WebDialer service must be enabled for exploitation, systems with this service disabled are not vulnerable.

Detection Guidance

This vulnerability can be detected by checking if the Cisco Unified Communications Manager or Cisco Unified Communications Manager Session Management Edition has the WebDialer service enabled, as exploitation requires this service to be active.

Since the vulnerability involves crafted HTTP requests exploiting improper input validation, monitoring HTTP traffic to the affected devices for unusual or suspicious requests targeting the WebDialer service endpoint may help detect attempts to exploit this issue.

No specific detection commands or tools are provided in the available resources.

Mitigation Strategies

The immediate mitigation step is to disable the WebDialer service on affected Cisco Unified Communications Manager and Unified CM SME devices, as this service must be enabled for exploitation.

Apply the software updates released by Cisco that address this vulnerability. These include updates such as 14SU6 for release 14 and 15SU5 (or COP 1 1) for release 15.

There are no workarounds available other than disabling the WebDialer service until patches can be applied.

Compliance Impact

The provided information does not specify how this vulnerability directly affects compliance with common standards and regulations such as GDPR or HIPAA.

Hi! I’m here to help you understand CVE-2026-20230. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70