CVE-2026-20230

Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability

View on CVE.org
Published Jun 3, 2026 CVSS 3.1 · 8.6 High EPSS 88.5% KEV · Listed
Description
A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device.

This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root.
Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.
Note: To exploit this vulnerability, the WebDialer service must be enabled. WebDialer is disabled by default.

Analysis

AI-generated

Technical impact

The vulnerability is a server‑side request forgery that allows an unauthenticated, remote attacker to send crafted HTTP requests to an affected Cisco Unified Communications Manager or its Unified CM Session Management Edition when the WebDialer service is enabled. Improper input validation of these requests permits the attacker to write files to the underlying operating system that could be used later to elevate privileges to root. Cisco has rated the vulnerability as Critical due to the full system compromise potential, and the issue is present only when WebDialer is active, a service that is disabled by default.

Affected Systems

Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition are impacted, but only installations where the WebDialer service is enabled are vulnerable. The service is disabled by default, so environments that have not explicitly enabled WebDialer are not affected, and no specific version details are provided.

Risk and Exploitability

The CVSS score of 8.6 and an EPSS score of 88% indicate a high severity with a very high likelihood of exploitation. This vulnerability is listed in the CISA KEV catalog, underscoring its real‑world exploitation risk. An attacker who can reach the affected device via the WebDialer interface can issue HTTP requests that result in arbitrary file writes, providing a direct path to privilege escalation on the CUCM host.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Cisco Unified Communications Manager patch that fixes CVE-2026-20230.
  • Disable the WebDialer service on all CUCM installations unless the service is strictly required.
  • Restrict inbound traffic to the CUCM appliance so that only trusted internal hosts can communicate with it, and configure outbound firewall rules to block or tightly control HTTP requests sent by the appliance to external hosts.

Generated by OpenCVE AI on August 24, 2026 at 16:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root. Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root. Note: To exploit this vulnerability, the WebDialer service must be enabled. WebDialer is disabled by default. A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root. Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root. Note: To exploit this vulnerability, the WebDialer service must be enabled. WebDialer is disabled by default.
Title SSRF Vulnerability in Cisco Unified Communications Manager Allows Privilege Escalation Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability
Type Values Removed Values Added
Title SSRF Vulnerability in Cisco Unified Communications Manager Allows Privilege Escalation
Type Values Removed Values Added
Title SSRF Vulnerability in Cisco Unified Communications Manager Enabling Privilege Escalation
Type Values Removed Values Added
Title SSRF Vulnerability in Cisco Unified Communications Manager Enabling Privilege Escalation
Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Metrics kev

{'dateAdded': '2026-06-25T00:00:00+00:00', 'dueDate': '2026-06-28T00:00:00+00:00'}
Type Values Removed Values Added
Title Server‑Side Request Forgery in Cisco Unified Communications Manager Enables Privilege Escalation
Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Server‑Side Request Forgery in Cisco Unified Communications Manager Enables Privilege Escalation
Type Values Removed Values Added
Title SSRF Enabling Arbitrary File Write and Privilege Escalation in Cisco Unified Communications Manager
Type Values Removed Values Added
Title SSRF Enabling Arbitrary File Write and Privilege Escalation in Cisco Unified Communications Manager
Type Values Removed Values Added
Title SSRF Vulnerability Allowing File Write and Root Privilege Escalation in Cisco Unified Communications Manager
Type Values Removed Values Added
Title SSRF Vulnerability Allowing File Write and Root Privilege Escalation in Cisco Unified Communications Manager
Type Values Removed Values Added
Title Server‑Side Request Forgery allows privilege escalation via WebDialer in Cisco Unified Communications Manager
Type Values Removed Values Added
Title Server‑Side Request Forgery allows privilege escalation via WebDialer in Cisco Unified Communications Manager
Type Values Removed Values Added
Title Server‑Side Request Forgery Enabling Root Privileges in Cisco Unified Communications Manager
Type Values Removed Values Added
Title Server‑Side Request Forgery Enabling Root Privileges in Cisco Unified Communications Manager
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Cisco
Cisco cisco Unified Communications Manager
Vendors & Products Cisco
Cisco cisco Unified Communications Manager
Type Values Removed Values Added
Description A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root. Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root. Note: To exploit this vulnerability, the WebDialer service must be enabled. WebDialer is disabled by default.
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N'}
Earlier changes (14)
Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)

Sources

Status
PUBLISHED
Assigner
cisco
Published
Updated
Oct 7, 2026, 6:09 PM
Reserved
Oct 8, 2025, 11:59 AM

View source JSON

Updated
Jun 3, 2026, 5:36 PM

JSON

Status
Analyzed
Published
Jun 3, 2026, 6:16 PM
Modified
Oct 7, 2026, 7:17 PM

View source JSON

No data.

Updated
Aug 24, 2026, 4:30 PM

JSON