CVE-2026-20230
CISA KEV
ACT NOW
Priority: 0.00
BB Relevance:
10/100
Published: N/A
Modified: N/A
First seen: 2026-10-29
Status: pending_score
Description
Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) Vulnerability that could allow an unauthenticated, remote attacker to write files to the underlying operating system that could be used later to elevate to root.
CISA Known Exploited Vulnerability
Vendor / Product
Cisco — Unified Communications Manager
Date Added
2026-06-25
Remediation Due
2026-06-28
https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-cucm-ssrf-cXPnHcW.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-20230
Weakness Classification (1)
Affected Software (4)
| Vendor | Product | Version |
|---|---|---|
| cisco | unified_communications_manager | 14.0 – 14su6 |
| cisco | unified_communications_manager | 14.0 – 14su6 |
| cisco | unified_communications_manager | 15.0 – 15su4a |
| cisco | unified_communications_manager | 15.0 – 15su4a |
References & Advisories (3)
Vendor Advisory
US Government Resource
Exploit
Third Party Advisory