CVE-2026-20230 is a server-side request forgery flaw in the WebDialer service of Cisco Unified Communications Manager and Unified CM Session Management Edition that lets a remote, unauthenticated attacker send a crafted HTTP request and write files to the underlying operating system — files that could later be used to elevate to root — and Cisco PSIRT confirmed active exploitation of the flaw beginning June 2026.
Vulnerability summary
8.6
High
88.5%
EPSS score (FIRST)
Yes
CISA KEV catalog
2026-06-03
Published
Vulnerability ID: CVE-2026-20230 · Source: NVD (Cisco PSIRT Secondary score only, not NVD Primary)
Affected components
| Component | CPE | Version range |
|---|---|---|
| Cisco Unified Communications Manager | cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:-:*:*:* | 14.0 through 14SU5 (fixed in 14SU6); 15.0 through 15SU4a (fix tracked for 15SU5); WebDialer service must be enabled (disabled by default) to be exploitable |
| Cisco Unified Communications Manager Session Management Edition | cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:session_management:*:*:* | 14.0 through 14SU5 (fixed in 14SU6); 15.0 through 15SU4a (fix tracked for 15SU5); same WebDialer precondition as Unified CM |
What this means
CVE-2026-20230 is a server-side request forgery (SSRF, CWE-918) vulnerability in Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (Unified CM SME). NVD's description states the flaw is "due to improper input validation for specific HTTP requests" and that "an attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device," with a successful exploit allowing the attacker "to write arbitrary files to the underlying operating system," which could subsequently be leveraged to escalate privileges to root (NVD).
As of this check, NVD's vulnStatus for the record is "Analyzed" but NVD has not published its own independent Primary CVSS metric; the only score on file is Cisco PSIRT's CNA Secondary submission of CVSS v3.1 8.6 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N — network-reachable, low attack complexity, no privileges or user interaction required, scope-changed, integrity-only impact. That score is attributed to Cisco, not NVD (NVD).
Cisco's own security advisory (cisco-sa-cucm-ssrf-cXPnHcW) confirms Unified CM and Unified CM SME releases 14.0 prior to 14SU6 and 15.0 prior to 15SU5 are affected, but only when the WebDialer service — disabled by default — has been enabled. Cisco states no permanent workaround exists; administrators awaiting a patch can temporarily disable the WebDialer service through Cisco Unified CM Administration's Control Center. Critically, Cisco's advisory states that "in June 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability," and that proof-of-concept exploit code is publicly available (Cisco Security Advisory cisco-sa-cucm-ssrf-cXPnHcW).
CISA added CVE-2026-20230 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-06-25, with a required-action due date of 2026-06-28 under Binding Operational Directive 26-04 (catalog confirmed live this run, matched by exact cveID string against the raw KEV feed) (CISA KEV).
As of 2026-10-31, FIRST scores the probability of exploitation at 0.8853 (99.77th percentile) — among the highest EPSS scores observed, consistent with confirmed active exploitation and public PoC code (FIRST EPSS).
Any Unified CM or Unified CM SME deployment with WebDialer enabled should be upgraded to 14SU6 or 15SU5 (or disable WebDialer as an interim step) immediately, given confirmed in-the-wild exploitation and a near-ceiling EPSS score.
Evidence
- SSRF due to improper input validation of HTTP requests lets a remote unauthenticated attacker write arbitrary files to the underlying OS, usable to later escalate to root. — NVD
- Only score on file is Cisco PSIRT's CNA Secondary CVSS v3.1 8.6, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N; NVD has not published an independent Primary metric for this record. — NVD
- Affects Unified CM/Unified CM SME 14.0 before 14SU6 and 15.0 before 15SU5 when WebDialer (disabled by default) is enabled; no permanent workaround besides disabling WebDialer; Cisco PSIRT became aware of active exploitation in June 2026 with public PoC code available. — Cisco Security Advisory cisco-sa-cucm-ssrf-cXPnHcW
- Added to the CISA Known Exploited Vulnerabilities catalog on 2026-06-25, due date 2026-06-28. Confirmed present in the live KEV feed by exact cveID match this run. — CISA KEV
- EPSS score is 0.8853 (99.77th percentile) as of 2026-10-31. — FIRST EPSS
