Cisco Unified Communications Manager (Unified CM) SSRF and Privilege Escalation Vulnerability (CVE-2026-20230)

1. Apply Official Patches

Refer to the Cisco Security Advisory to download and install the appropriate software updates for your deployment.

2. Temporary Mitigation (Workaround)

If patching cannot be performed immediately, disable the WebDialer service to mitigate the attack vector.

• Disabling via Cisco Unified Serviceability:
• Log in to the Cisco Unified Serviceability administration page.
• Navigate to Tools > Service Activation.
• Select the active server, locate Cisco WebDialer Web Service, uncheck it to deactivate, and save the changes.

• CLI Verification and Service Stop Example:

  # Check the status of the WebDialer service
  utils service list | i WebDialer
  
  # Stop the service if it is running
  utils service stop Cisco WebDialer Web Service

A critical vulnerability (CVE-2026-20230) has been identified in Cisco Unified Communications Manager (Unified CM) and Unified CM SME. The root cause is improper input validation for specific HTTP requests, leading to Server-Side Request Forgery (SSRF, CWE-918).

An unauthenticated, remote attacker can exploit this by sending a crafted HTTP request to an affected device. A successful exploit allows the attacker to write arbitrary files to the underlying operating system, which can be leveraged to elevate privileges to root. Although the CVSS v3.1 score is 8.6 (High), Cisco has assigned a Security Impact Rating (SIR) of Critical due to the high risk of root-level privilege escalation.

This vulnerability is actively exploited in the wild and is listed in the CISA KEV catalog, with an EPSS score of 0.94. Note that the WebDialer service must be enabled for this vulnerability to be exploitable (it is disabled by default).