# Cisco Unified CM WebDialer SSRF (CVE-2026-20230) — Unauthenticated SSRF Chained to Arbitrary File Write Enabling Root Compromise; Public PoC Available

> CVE-2026-20230 is an unauthenticated server-side request forgery (SSRF) flaw in the Cisco Unified Communications Manager (Unified CM) and Session Management Edition WebDialer service. Improper input validation of crafted HTTP requests lets a remote attacker coerce the server into making attacker-influenced requests that can be chained into arbitrary file write on the underlying OS, which Cisco rates as enabling root-level compromise. Cisco PSIRT confirms public proof-of-concept exploit code exists; no confirmed in-the-wild exploitation as of disclosure.

- **Published:** 2026-06-06T00:00:00Z
- **Last reviewed:** 2026-06-06T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0688
- **ID:** TL-2026-0688
- **Severity:** CRITICAL (CVSS 8.6)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-20230

## Description

Cisco disclosed CVE-2026-20230 on 2026-06-04 in advisory cisco-sa-cucm-ssrf-cXPnHcW, a server-side request forgery (SSRF, CWE-918) vulnerability rooted in improper input validation (CWE-20) within the Cisco WebDialer Web Service component of Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME). The WebDialer service is a click-to-call CTI web application that processes HTTP requests; it is disabled by default but is commonly enabled in enterprise voice deployments to support click-to-dial integrations.

The vulnerability allows a remote, unauthenticated attacker to send a crafted HTTP request to the WebDialer endpoint that contains insufficiently validated parameters. Because the service fails to validate request-controlled fields before using them to construct outbound/internal requests, an attacker can coerce the server into issuing attacker-influenced requests (classic SSRF), routing traffic to restricted internal network locations and loopback-bound management APIs that are otherwise unreachable from outside the appliance.

The critical escalation, and the reason Cisco assigned a Critical impact rating despite the 8.6 CVSS base score, is that the SSRF primitive can be chained into arbitrary file write on the underlying OS. By directing the coerced request flow at internal handlers, an attacker can write files to privileged system locations. Public reporting indicates the file-write capability can land content in root-executed contexts such as /etc/cron.d/, where a planted cron entry is executed by the system cron daemon as root, converting a network-reachable input-validation flaw into full root compromise of the appliance. A root-compromised Unified CM server yields control over all organizational voice and video communications, call routing, CDR/CTI data, and credential material stored on the platform, and provides a pivot into the broader collaboration and management network.

The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N (8.6): network attack vector, low complexity, no privileges, no user interaction, with a scope change reflecting that the WebDialer-confined flaw impacts the underlying OS, and a high integrity impact corresponding to arbitrary file write. Cisco PSIRT explicitly states it is aware that proof-of-concept exploit code is publicly available, though no in-the-wild exploitation had been observed at disclosure.

Fixed software is available: Unified CM and Unified CM SME 14SU6 contains the fix, and the v15 train is scheduled to be fixed in 15SU5 (expected September 2026) with interim COP (Cisco Options Package) patches available in the interim. The primary mitigation, where patching is not immediately possible, is to disable the Cisco WebDialer Web Service via Cisco Unified Serviceability, which removes the reachable attack surface since exploitation is gated on the service being enabled.

## MITRE ATT&CK

- T1595 Active Scanning
- T1590 Gather Victim Network Information
- T1190 Exploit Public-Facing Application
- T1053 Scheduled Task/Job
- T1059 Command and Scripting Interpreter
- T1068 Exploitation for Privilege Escalation
- T1070 Indicator Removal
- T1046 Network Service Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1552 Unsecured Credentials

## Sources

- [Cisco warns of critical Unified CM flaw with PoC exploit code](https://www.bleepingcomputer.com/news/security/cisco-warns-of-critical-unified-cm-flaw-with-poc-exploit-code/)
- [CVE-2026-20230: Cisco Unified CM WebDialer SSRF Can Lead to Root-Level Compromise](https://socradar.io/blog/cve-2026-20230-cisco-unified-cm-webdialer-ssrf/)
- [Cisco Warns of Available PoC for Critical Unified CM Vulnerability](https://www.securityweek.com/cisco-warns-of-available-poc-for-critical-unified-cm-vulnerability/)
- [Cisco Unified CM SSRF to Root (CVE-2026-20230): Exploit Code Publicly Available](https://threat-modeling.com/cisco-unified-cm-ssrf-root-cve-2026-20230/)
- [Cisco Unified Communications Manager Vulnerability Exposed Along With PoC Exploit Code](https://cybersecuritynews.com/cisco-unified-communications-manager-vulnerability/)
- [CVE-2026-20230 report (CVSS vector, CWE-918/CWE-20)](https://cvereports.com/reports/CVE-2026-20230)
- [Cisco Security Advisory cisco-sa-cucm-ssrf-cXPnHcW](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0688