CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Cisco Unified Communications Manager

product · product:cisco-unified-communications-manager

Coverage
1
first 2026-06-24 → last 2026-10-11
Latest activity
2026-06-24
An unauthenticated SSRF in Cisco Unified CM's WebDialer leads to root; Cisco and CISA confirm exploitation
Peak priority
high
1 high
Targets
technology
sectors: technology
Sources cited
3
3 hosts

Action items (1)

Do-now tasks recorded on the entries about Cisco Unified Communications Manager, newest first. Check the date before acting on an older one.

  • On every Unified CM and Unified CM SME node, check whether the Cisco WebDialer Web Service is Started; disable it where unused, and otherwise apply 14SU6 or the Release 15 COP.
    2026-06-24CVE-2026-20230

Defender insights

What each entry about Cisco Unified Communications Manager tells a defender to do, newest first.

2026-06-24HIGHexploitedAn unauthenticated SSRF in Cisco Unified CM's WebDialer leads to root; Cisco and CISA confirm exploitation

Exposure · detection

Story timeline

  1. 2026-06-24CVE-2026-20230: Cisco Unified CM WebDialer SSRF to root file write, exploited and KEV-listed; WebDialer is off by default
    trending-vulnerabilitiesAn unauthenticated SSRF in Cisco Unified CM's WebDialer leads to root; Cisco and CISA confirm exploitation

Hunting pivots

CVEs (exploited first)
CVE-2026-20230
Releases covered
Cisco Unified Communications Manager
Tags
actively-exploitedcisa-kevpatch-availablepre-authvulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • Privilege EscalationExploitation for Privilege Escalation

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-06-24/cve-2026-20230-cisco-unified-cm-webdialer-ssrf-to-arbitrary · ATT&CK page ↗

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-06-24/cve-2026-20230-cisco-unified-cm-webdialer-ssrf-to-arbitrary · ATT&CK page ↗

Entries about Cisco Unified Communications Manager (1)

2026-06-24 · view entry permalink →

HIGHCVE-2026-20230exploitedupdatedNATOA1

CVE-2026-20230: Cisco Unified CM WebDialer SSRF to root file write, exploited and KEV-listed; WebDialer is off by default

CVE-2026-20230 (CVSS 8.6) is a server-side request forgery in Cisco Unified Communications Manager and Unified CM Session Management Edition that lets an unauthenticated remote attacker write files and, Cisco says, elevate privileges to root, which is why it rates the advisory Critical (Cisco PSIRT). Only systems with the WebDialer service enabled are affected, and WebDialer is disabled by default; there is no workaround, but disabling WebDialer mitigates until a fix is applied (Cisco PSIRT). Fixed releases are 14SU6 and, for Release 15, 15SU5 (September 2026) or a version-specific COP patch (Cisco PSIRT).

Defused reported exploitation over the weekend before 2026-06-23 from a single IP address, using file:// payloads to create files on the device in what appears to be a check for vulnerable systems (BleepingComputer, 2026-06-23). CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-06-25 (CISA KEV catalog, 2026-06-25), and Cisco updated its advisory on 2026-07-01 to say it became aware of active exploitation in June and that proof-of-concept code is available (Cisco PSIRT).

In June 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability.

Cisco PSIRT 2026-07-01
Correctionrun 2026-10-11T1307Z-audittitleheadlinesummarytagstechniquesaffected_productscvessourcesevidenceclassificationactionsbody

CISA added CVE-2026-20230 to its KEV catalog on 2026-06-25 (CISA KEV catalog, 2026-06-25), and Cisco's advisory revision of 2026-07-01 confirms active exploitation in June and the availability of proof-of-concept code (Cisco PSIRT). Defused's observation came over the weekend before BleepingComputer's report of 2026-06-23 (BleepingComputer, 2026-06-23).

vulnerability24 Jun 05:11Zmulti-sourceOpen finding →
Sources: Cisco PSIRT · BleepingComputer · CISA KEV catalog

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • bleepingcomputer.com1 (33%)
  • cisa.gov1 (33%)
  • sec.cloudapps.cisco.com1 (33%)
All cited sources (3)