CVE-2026-20230

Confirmed PUBLISHED

Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability

Cisco · Cisco Unified Communications Manager

2 days faster than CISA KEV

Exploited in the wild Active exploitation observed PoC available Virtual patch available

Recommended Action

Prioritize immediate patching and validate internet-facing exposure. Monitor for matching exploitation attempts in your environment.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Active exploitation observed

Observed in Sensors

Yes

Attempts (30d)

496

Unique Attacker IPs

CISA KEV

In CISA KEV

Virtual Patch

Yes 3 targets

CVSS / EPSS

8.6 High EPSS 41.7%

At a Glance

A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root. Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root. Note: To exploit this vulnerability, the WebDialer service must be enabled. WebDialer is disabled by default.

edge cisa

CVE Published: Jun 03, 2026
Exploitation Reported: Jun 23, 2026
CVSS: 8.6 High
EPSS: 41.7%

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
Cisco	Cisco Unified Communications Manager	14	Affected
Cisco	Cisco Unified Communications Manager	14SU1	Affected
Cisco	Cisco Unified Communications Manager	14SU2	Affected
Cisco	Cisco Unified Communications Manager	14SU3	Affected
Cisco	Cisco Unified Communications Manager	15	Affected
Cisco	Cisco Unified Communications Manager	15SU1	Affected
Cisco	Cisco Unified Communications Manager	14SU4	Affected
Cisco	Cisco Unified Communications Manager	14SU4a	Affected
Cisco	Cisco Unified Communications Manager	15SU1a	Affected
Cisco	Cisco Unified Communications Manager	15SU2	Affected
Cisco	Cisco Unified Communications Manager	15.0.1.13010-1	Affected
Cisco	Cisco Unified Communications Manager	15.0.1.13011-1	Affected
Cisco	Cisco Unified Communications Manager	15.0.1.13012-1	Affected
Cisco	Cisco Unified Communications Manager	15.0.1.13013-1	Affected
Cisco	Cisco Unified Communications Manager	15.0.1.13014-1	Affected
Cisco	Cisco Unified Communications Manager	15.0.1.13015-1	Affected
Cisco	Cisco Unified Communications Manager	15.0.1.13016-1	Affected
Cisco	Cisco Unified Communications Manager	15.0.1.13017-1	Affected
Cisco	Cisco Unified Communications Manager	15SU3a	Affected
Cisco	Cisco Unified Communications Manager	14SU5	Affected
Cisco	Cisco Unified Communications Manager	15SU4	Affected
Cisco	Cisco Unified Communications Manager	15SU4a	Affected

CVE References

cisco-sa-cucm-ssrf-cXPnHcW sec.cloudapps.cisco.com · CVE Record https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurity...

Recommended Actions

Prioritize immediate patching and validate internet-facing exposure. Monitor for matching exploitation attempts in your environment.
Review sensor telemetry for request paths, attacker IPs, and payload patterns that may inform detection and exposure validation.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
BleepingComputer First	2026-06-23 22:20 UTC
TheHackerNews	2026-06-24 08:20 UTC
CISA	2026-06-25 00:00 UTC
KEVIntel	2026-06-25 02:35 UTC
CVE	2026-06-25 20:10 UTC
All CISA Advisories	2026-06-25 21:20 UTC
The Shadowserver	2026-07-10 00:00 UTC

Operational indicators for this CVE are listed on the Detection tab.

Indicators of Compromise (IoCs)

Operational indicators linked to exploitation of this CVE. IoCs age over time — especially IP addresses.

Type Indicator First Seen Last Seen Age Source

File hash

Type	Indicator	First Seen	Last Seen	Age	Source
File hash	`f96d3df92d9dd8651d0314c9742f5252` MD5 KEVIntel has identified a payload being downloaded during exploitation of Cisco Unified Communications Manager SSRF: Binary: gpg-bus Install path: ~/.local/.agent/ MD5: f96d3df92d9dd8651d0314c9742f5252	2026-06-26 15:15 UTC	2026-06-26 15:15 UTC	18 days ago	—

f96d3df92d9dd8651d0314c9742f5252

MD5

KEVIntel has identified a payload being downloaded during exploitation of Cisco Unified Communications Manager SSRF: Binary: gpg-bus Install path: ~/.local/.agent/ MD5: f96d3df92d9dd8651d0314c9742f5252

2026-06-26 15:15 UTC

18 days ago

—

Observed Detection Signals (30d)

Aggregate counts from KEVIntel sensor telemetry for this CVE.

Distinct request paths: 13
Distinct User-Agents: 20

The specific request paths and User-Agents attackers are using are available on Pro and Enterprise plans.

Request Enterprise Access Compare plans Create free account

CVSS Scores

CVSS v3.1 8.6 High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Exploitation Status

Exploited in the wild

Recorded 2026-06-23 22:20:36 UTC · BleepingComputer

Active exploitation observed

Recorded 2026-06-25 02:30:18 UTC · KEVIntel sensor

Proof of concept available

Recorded 2026-06-05 01:17:53 UTC · GitHub

Weaknesses (CWE)

CWE-918

Server-Side Request Forgery (SSRF)

Recent Mentions

CISA Adds Two Known Exploited Vulnerabilities to Catalog

All CISA Advisories · Jun 25, 2026

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-12569 PTC Windchill and FlexPLM Improper Input Validation Vulnerability CVE-2026-20230 Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.

The hits keep on coming for Cisco vulnerabilities

TheRegister · Jun 24, 2026

CVE-2026-20230 under exploitation, while an earlier SD-WAN 0-day looks even worse than we thought

Cisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to Root

TheHackerNews · Jun 24, 2026

Threat actors have begun to exploit a recently disclosed critical security flaw impacting Cisco Unified Communications Manager (Unified CM) and Unified Communications Manager Session Management Edition (Unified CM SME). The vulnerability, tracked as CVE-2026-20230 (CVSS score: 8.6), is a case of improper input validation for specific HTTP requests that could allow an unauthenticated, remote

Cisco Unified CM flaw CVE-2026-20230 now exploited in attacks

BleepingComputer · Jun 23, 2026

A high-severity SSRF vulnerability, tracked as CVE-2026-20230, in Cisco Unified Communications Manager Server is now being exploited in attacks. [...]

Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public

TheHackerNews · Jun 04, 2026

Cisco has patched a bug in Unified Communications Manager that lets an unauthenticated attacker on the network write files to the box and, from there, climb to root. It is tracked as CVE-2026-20230, and proof-of-concept exploit code is already public. Cisco's PSIRT says it has not seen the flaw used in attacks yet. The PoC shortens that runway. The flaw is a server-side request forgery.

SSRF to Root: Unauthenticated File-Write Flaw in Cisco Unified CM (CVE-2026-20230)

DarkWebInformer · Jun 04, 2026

CVE-2026-20230 is an unauthenticated, remote server-side request forgery (SSRF) vulnerability in Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (Unified CM SME).

Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability

Cisco Security Advisory · Jun 03, 2026

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

W5M1n9/Cisco-Unified-Communications-Manager-Server-Side-Forgery-Request-Vulnerability-CVE-2026-20230

github · Created 2026-06-25 09:56:26 UTC · 0 stars

HalilDeniz/CVE-2026-20230-Scanner

github · Created 2026-06-12 19:47:29 UTC · 0 stars

Cisco Unified Communications Manager (Unified CM) deployments affected by CVE-2026-20230.

HORKimhab/CVE-2026-20230

github · Created 2026-06-05 01:17:53 UTC · 0 stars

CVE-2026-20230 - Cisco Unified CM

Timeline

Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.

10 Jul 2026 00:00 UTC 5 days ago

10 Jul 2026 00:00 UTC · 5 days ago

KEV confirmed by The Shadowserver

Exploitation attested by an external source
25 Jun 2026 21:20 UTC 19 days ago

25 Jun 2026 21:20 UTC · 19 days ago

KEV confirmed by All CISA Advisories

Exploitation attested by an external source
25 Jun 2026 20:10 UTC 19 days ago

25 Jun 2026 20:10 UTC · 19 days ago

KEV confirmed by CVE

Exploitation attested by an external source
25 Jun 2026 10:00 UTC 19 days ago

25 Jun 2026 10:00 UTC · 19 days ago

Virtual patch available

Compensating WAF rule available to block exploitation
25 Jun 2026 02:30 UTC 19 days ago

25 Jun 2026 02:30 UTC · 19 days ago

Observed by KEVIntel sensors

Evidence-backed exploitation signal
25 Jun 2026 02:30 UTC 19 days ago

25 Jun 2026 02:30 UTC · 19 days ago

Indicators of compromise added (25)

Indicators of compromise recorded
25 Jun 2026 00:00 UTC 20 days ago

25 Jun 2026 00:00 UTC · 20 days ago

Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
24 Jun 2026 08:20 UTC 20 days ago

24 Jun 2026 08:20 UTC · 20 days ago

KEV confirmed by TheHackerNews

Exploitation attested by an external source
23 Jun 2026 22:20 UTC 21 days ago

23 Jun 2026 22:20 UTC · 21 days ago

Added to KEVIntel KEV Feed

High-confidence, third-party attested exploitation
5 Jun 2026 01:17 UTC about 1 month ago

5 Jun 2026 01:17 UTC · about 1 month ago

Public PoC available

Public proof-of-concept code published
3 Jun 2026 16:09 UTC about 1 month ago

3 Jun 2026 16:09 UTC · about 1 month ago

CVE published

Vulnerability disclosed publicly
8 Oct 2025 11:59 UTC 9 months ago

8 Oct 2025 11:59 UTC · 9 months ago

CVE ID reserved

Identifier reserved by the CNA

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2026-20230

{
  "cve_id": "CVE-2026-20230",
  "title": "Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability",
  "affected_vendor": "Cisco",
  "affected_product": "Cisco Unified Communications Manager",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 8.6,
  "epss_score": 0.41694,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": true
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2026-20230

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Observed Exploitation Attempts

Exploitation Attempts Over the Last 21 Days

See more exploitation detail

Indicators of Compromise (IoCs)

Observed Detection Signals (30d)

Virtual Patch

Supported Platforms

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Recent Mentions

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API