Cisco Unified CM WebDialer SSRF (CVE-2026-20230) — Unauthenticated SSRF Chained to Arbitrary File Write Enabling Root Compromise; Public PoC Available

Cisco Unified CM WebDialer SSRF (CVE-2026-20230) (TL-2026-0688), also tracked as cisco-sa-cucm-ssrf-cXPnHcW, is a critical-severity software vulnerability scored CVSS 8.6, first published 2026-06-06. It has no confirmed attribution, affects Cisco Unified Communications Manager (Unified CM), references 1 CVE (CVE-2026-20230), maps to 11 MITRE ATT&CK techniques (T1005, T1046, T1053), and is covered by 9 detection rules and 13 indicators of compromise.

Key facts for TL-2026-0688

Threat ID
TL-2026-0688
Also known as
cisco-sa-cucm-ssrf-cXPnHcW, Cisco Unified CM WebDialer SSRF
Severity
CRITICAL
CVSS
8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-06-06
Last reviewed
2026-06-06
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
enterprise, telecommunications, government, financial, healthcare, education
Target regions
Global
Detection rules
9
Indicators of compromise
13

CVE-2026-20230 is an unauthenticated server-side request forgery (SSRF) flaw in the Cisco Unified Communications Manager (Unified CM) and Session Management Edition WebDialer service. Improper input validation of crafted HTTP requests lets a remote attacker coerce the server into making attacker-influenced requests that can be chained into arbitrary file write on the underlying OS, which Cisco rates as enabling root-level compromise. Cisco PSIRT confirms public proof-of-concept exploit code exists; no confirmed in-the-wild exploitation as of disclosure.

How Cisco Unified CM WebDialer SSRF (CVE-2026-20230) works

Cisco disclosed CVE-2026-20230 on 2026-06-04 in advisory cisco-sa-cucm-ssrf-cXPnHcW, a server-side request forgery (SSRF, CWE-918) vulnerability rooted in improper input validation (CWE-20) within the Cisco WebDialer Web Service component of Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME). The WebDialer service is a click-to-call CTI web application that processes HTTP requests; it is disabled by default but is commonly enabled in enterprise voice deployments to support click-to-dial integrations.

The vulnerability allows a remote, unauthenticated attacker to send a crafted HTTP request to the WebDialer endpoint that contains insufficiently validated parameters. Because the service fails to validate request-controlled fields before using them to construct outbound/internal requests, an attacker can coerce the server into issuing attacker-influenced requests (classic SSRF), routing traffic to restricted internal network locations and loopback-bound management APIs that are otherwise unreachable from outside the appliance.

The critical escalation, and the reason Cisco assigned a Critical impact rating despite the 8.6 CVSS base score, is that the SSRF primitive can be chained into arbitrary file write on the underlying OS. By directing the coerced request flow at internal handlers, an attacker can write files to privileged system locations. Public reporting indicates the file-write capability can land content in root-executed contexts such as /etc/cron.d/, where a planted cron entry is executed by the system cron daemon as root, converting a network-reachable input-validation flaw into full root compromise of the appliance. A root-compromised Unified CM server yields control over all organizational voice and video communications, call routing, CDR/CTI data, and credential material stored on the platform, and provides a pivot into the broader collaboration and management network.

The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N (8.6): network attack vector, low complexity, no privileges, no user interaction, with a scope change reflecting that the WebDialer-confined flaw impacts the underlying OS, and a high integrity impact corresponding to arbitrary file write. Cisco PSIRT explicitly states it is aware that proof-of-concept exploit code is publicly available, though no in-the-wild exploitation had been observed at disclosure.

Fixed software is available: Unified CM and Unified CM SME 14SU6 contains the fix, and the v15 train is scheduled to be fixed in 15SU5 (expected September 2026) with interim COP (Cisco Options Package) patches available in the interim. The primary mitigation, where patching is not immediately possible, is to disable the Cisco WebDialer Web Service via Cisco Unified Serviceability, which removes the reachable attack surface since exploitation is gated on the service being enabled.

MITRE ATT&CK techniques used in TL-2026-0688

Collection

T1005 Data from Local System

Discovery

T1046 Network Service Discovery; T1082 System Information Discovery

Execution

T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Defense Evasion

T1070 Indicator Removal

Initial Access

T1190 Exploit Public-Facing Application

Credential Access

T1552 Unsecured Credentials

Reconnaissance

T1590 Gather Victim Network Information; T1595 Active Scanning

Affected products and versions in Cisco Unified CM WebDialer SSRF (CVE-2026-20230)

  • Cisco — Unified Communications Manager (Unified CM)
    Vulnerable versions: 12.5; 14 (pre-14SU6); 15 (pre-15SU5)
    Fixed in: 14SU6; 15SU5 (expected Sept 2026); interim COP patches for v15
  • Cisco — Unified Communications Manager Session Management Edition (Unified CM SME)
    Vulnerable versions: 14 (pre-14SU6); 15 (pre-15SU5)
    Fixed in: 14SU6; 15SU5 (expected Sept 2026); interim COP patches for v15

Remediation for Cisco Unified CM WebDialer SSRF (CVE-2026-20230)

Patches

  • Upgrade Unified CM / Unified CM SME to 14SU6 (fixed)
  • Apply interim COP patches for the v15 train pending 15SU5 (expected September 2026)

Immediate actions

  • Disable the Cisco WebDialer Web Service via Cisco Unified Serviceability on any Unified CM / Unified CM SME node where it is not strictly required
  • Restrict network access to the Unified CM administrative and CTI/WebDialer HTTP interfaces to trusted management networks only
  • Inventory all Unified CM and Unified CM SME nodes and confirm whether WebDialer is enabled

Workarounds

  • Disable the Cisco WebDialer Web Service (service is disabled by default; only enabled deployments are exposed)

Longer-term hardening

  • Apply fixed software and establish a recurring Cisco PSIRT advisory review cadence for the collaboration estate
  • Segment Unified CM appliances away from general user VLANs and block inbound access to management/CTI ports from untrusted zones
  • Deploy file integrity monitoring on Unified CM OS paths (e.g., /etc/cron.d/) and centralize appliance logs to a SIEM
  • Monitor for unexpected outbound/internal requests originating from the WebDialer/Tomcat service process

CVEs associated with Cisco Unified CM WebDialer SSRF (CVE-2026-20230)

CVE-2026-20230

Weaknesses (CWE) in Cisco Unified CM WebDialer SSRF (CVE-2026-20230)

CWE-918, CWE-20

Timeline of Cisco Unified CM WebDialer SSRF (CVE-2026-20230)

  • BleepingComputer, SecurityWeek, SOCRadar and others report on the flaw and the availability of public PoC exploit code.
  • Fixed software released in Unified CM / Unified CM SME 14SU6; interim COP patches made available for the v15 train.
  • Cisco assigns a Critical impact rating (CVSS base 8.6) because the SSRF can be chained to arbitrary file write and root-level compromise.
  • Cisco PSIRT states it is aware that public proof-of-concept exploit code exists for the vulnerability.
  • Cisco publishes security advisory cisco-sa-cucm-ssrf-cXPnHcW disclosing CVE-2026-20230, an unauthenticated SSRF in the Unified CM / Unified CM SME WebDialer Web Service.
  • Threadlinqs Intelligence ingests and analyzes CVE-2026-20230 for detection and simulation coverage.
  • Cisco Unified CM / SME 15SU5 with the permanent v15 fix expected (September 2026).

Sources cited for Cisco Unified CM WebDialer SSRF (CVE-2026-20230)

Threats related to Cisco Unified CM WebDialer SSRF (CVE-2026-20230)

Detection coverage for TL-2026-0688

As of 2026-06-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0688 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats