# CISA KEV: Cisco Unified Communications Manager SSRF to Webshell (CVE-2026-20230) Actively Exploited

> CVE-2026-20230 is an unauthenticated Server-Side Request Forgery in Cisco Unified Communications Manager's WebDialer service, actively exploited to deploy two-stage JSP webshells via Apache Axis2 service abuse. CISA added this vulnerability to the Known Exploited Vulnerabilities catalog on June 25, 2026 with a BOD 26-04 federal remediation deadline of June 28, 2026. Attackers route C2 traffic through Tor and are conducting automated mass-exploitation sweeps against internet-exposed UCM instances.

- **Published:** 2026-06-27T00:00:00Z
- **Last reviewed:** 2026-08-19T13:11:02Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0960
- **ID:** TL-2026-0960
- **Severity:** CRITICAL (CVSS 8.6)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-20230, CVE-2026-12569

## Description

CVE-2026-20230 is a Server-Side Request Forgery (CWE-918) vulnerability in the WebDialer component of Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME). Cisco published advisory cisco-sa-cucm-ssrf-cXPnHcW on June 3, 2026. The vulnerability allows an unauthenticated remote attacker to send specially crafted HTTP requests to the WebDialer service, exploiting its failure to properly validate inbound request parameters.

The exploitation chain proceeds in two stages. In the first stage, the attacker leverages the SSRF to force the WebDialer service to make unintended internal HTTP requests, which are used to install a rogue Apache Axis2 web service on the target. The target hostname required to craft the SSRF payload is obtainable via a separate unauthenticated endpoint, removing it as a meaningful barrier to exploitation. In the second stage, the attacker uses the newly installed Axis2 service to write a JSP file-writer payload to disk, which is subsequently used to drop a full command-execution webshell into the /platform-services/axis2-web/ directory of the application server. The resulting webshell provides unauthenticated remote command execution with the privileges of the application server process, effectively achieving full system compromise from an unauthenticated HTTP request.

WebDialer is disabled by default in Cisco Unified CM, but is routinely enabled by organizations using click-to-call functionality — a common deployment pattern in healthcare, financial services, government, and telecommunications environments. Affected releases include Unified CM 14.0 through 14SU5 and 15.0 through 15SU4a, and all equivalent SME versions. Fixed releases are 14SU6 and 15SU5; Cisco also released interim COP patches for the 15.x branch.

A public proof-of-concept exploit was released on June 5, 2026 — two days after the advisory. Active exploitation was first observed by Defused Cyber honeypots on June 22–23, 2026, confirming automated sweeps targeting internet-exposed UCM instances. A second, more complete PoC was published June 25, 2026. All observed attacker C2 traffic has been routed through the Tor anonymization network, making attribution difficult. CISA added CVE-2026-20230 to its Known Exploited Vulnerabilities catalog on June 25, 2026, imposing a BOD 26-04 federal remediation deadline of June 28, 2026.

This KEV entry was published simultaneously with CVE-2026-12569, a critical unauthenticated Java deserialization RCE in PTC Windchill PDMlink and FlexPLM (CVSS 9.8). The PTC vulnerability has confirmed C2 infrastructure (5.180.41.35) and is being exploited to deploy JSP webshells with naming pattern /Windchill/login/[0-9a-f]{16}.jsp, targeting manufacturing, engineering, and PLM-heavy sectors.

For CVE-2026-20230, immediate mitigation options include: (1) applying the vendor patch (14SU6 or 15SU5), (2) disabling the WebDialer service if click-to-call is not required, and (3) restricting internet access to Unified CM management interfaces. The threat actor identity remains unknown; no formal attribution has been made as of June 27, 2026.

## MITRE ATT&CK

- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1588 Obtain Capabilities
- T1583 Acquire Infrastructure
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1610 Deploy Container
- T1505 Server Software Component
- T1543 Create or Modify System Process
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1685 Disable or Modify Tools
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1046 Network Service Discovery
- T1018 Remote System Discovery
- T1049 System Network Connections Discovery
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1090 Proxy
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel
- T1529 System Shutdown/Reboot

## Sources

- [CISA Sets Urgent Deadline to Fix Cisco Flaw Exploited in Attacks](https://www.bleepingcomputer.com/news/security/cisa-sets-urgent-deadline-to-fix-cisco-flaw-exploited-in-attacks/)
- [Cisco Security Advisory: cisco-sa-cucm-ssrf-cXPnHcW](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW)
- [CISA Adds Two Known Exploited Vulnerabilities to Catalog (June 25, 2026)](https://www.cisa.gov/news-events/alerts/2026/06/25/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [CISA Known Exploited Vulnerabilities Catalog JSON Feed](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [NVD CVE Detail: CVE-2026-20230](https://nvd.nist.gov/vuln/detail/CVE-2026-20230)
- [Horizon3.ai: CVE-2026-20230 — Cisco Unified CM SSRF to RCE](https://horizon3.ai/attack-research/vulnerabilities/cve-2026-20230/)
- [Cisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to Root](https://thehackernews.com/2026/06/cisco-unified-cm-flaw-exploited-after.html)
- [Cisco Unified CM Flaw Exploited to Drop Webshells (CVE-2026-20230)](https://www.helpnetsecurity.com/2026/06/24/cisco-unified-cm-flaw-exploited-to-drop-webshells-cve-2026-20230/)
- [Hackers Exploiting Cisco Unified CM Vulnerability](https://www.securityweek.com/hackers-exploiting-cisco-unified-cm-vulnerability/)
- [CVE-2026-20230 SSRF to RCE Technical Analysis](https://threat-modeling.com/cve-2026-20230-cisco-unified-communications-manager-ssrf-rce/)
- [Cisco Unified CM SME Flaw CVE-2026-20230 Now Exploited in Attacks](https://www.bleepingcomputer.com/news/security/cisco-unified-cm-sme-flaw-cve-2026-20230-now-exploited-in-attacks/)
- [CISA Adds Exploited PTC Windchill RCE Flaw to KEV (CVE-2026-12569)](https://thehackernews.com/2026/06/cisa-adds-exploited-ptc-windchill-rce.html)
- [PTC Trust Center Advisory: Windchill PDMlink / FlexPLM RCE](https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/windchill-flexplm-rce-vulnerability)
- [NVD CVE Detail: CVE-2026-12569](https://nvd.nist.gov/vuln/detail/CVE-2026-12569)
- [Hackers Exploit Critical PTC Windchill PLM Software Flaw (CVE-2026-12569)](https://www.csoonline.com/article/4190154/hackers-exploit-critical-ptc-windchill-plm-software-flaw.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0960