CVE-2026-20230: Active Exploitation of Cisco Unified CM WebDialer SSRF Flaw Leading to Root-Level Compromise
CVE-2026-20230 (TL-2026-1070), also tracked as Cisco Unified CM WebDialer SSRF, is a high-severity software vulnerability scored CVSS 8.6, first published 2026-07-02. It has no confirmed attribution, affects Cisco Unified Communications Manager (Unified CM), references 1 CVE (CVE-2026-20230), maps to 13 MITRE ATT&CK techniques (T1036, T1046, T1059), and is covered by 9 detection rules and 21 indicators of compromise.
Key facts for TL-2026-1070
- Threat ID
- TL-2026-1070
- Also known as
- Cisco Unified CM WebDialer SSRF, Cisco CUCM SSRF-to-RCE
- Severity
- HIGH
- CVSS
- 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-07-02
- Last reviewed
- 2026-07-02
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- telecoms, enterprise-voip, government administration, finance, health, critical-infrastructure
- Target regions
- Asia, North America, Global
- Detection rules
- 9
- Indicators of compromise
- 21
Cisco confirmed on July 2, 2026 active in-the-wild exploitation of CVE-2026-20230, a CVSS 8.6 unauthenticated SSRF vulnerability in the WebDialer service of Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition. Threat intelligence firm Defused first observed file:// SSRF payloads being used to write files to the underlying OS starting June 21-22, 2026, with the attack chain culminating in root-level compromise via a rogue Apache Axis service and staged JSP web shells.
How CVE-2026-20230 works
CVE-2026-20230 is a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) in the WebDialer service of Cisco Unified Communications Manager (Unified CM, formerly CallManager) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME). The flaw stems from improper input validation of specific HTTP requests processed by WebDialer, allowing an unauthenticated, remote attacker to submit crafted HTTP requests that force the application to make unintended server-side requests. When WebDialer accepts file:// scheme payloads, an attacker can coerce the application into writing arbitrary files to the underlying operating system.
Cisco publicly disclosed and patched the vulnerability on June 3, 2026 (advisory cisco-sa-cucm-ssrf-cXPnHcW), at the time noting that proof-of-concept code existed but stating it had no evidence of active exploitation. Within roughly three weeks, threat intelligence firm Defused observed the vulnerability being actively exploited in the wild beginning the weekend of June 21-22, 2026, using file:// SSRF payloads to plant files on targeted Unified CM appliances. Independent researchers at SSD Secure published a technical writeup and working PoC on June 23, 2026, and public exploitation was reportedly weaponized within 24 hours of the technical details becoming available.
The observed attack chain begins with the unauthenticated SSRF against the WebDialer endpoint, which is used to deploy a rogue Apache Axis service on the appliance. That rogue Axis service is then abused to write a first-stage JSP file-writer web shell to a web-accessible directory, which in turn is used to drop a second-stage command-execution shell, giving the attacker persistent remote code execution. Cisco assessed the overall impact as Critical (despite the CVSS base score of 8.6, which nominally maps to High) because successful exploitation can be leveraged to elevate privileges to root on the underlying appliance operating system, resulting in complete compromise of the Unified CM instance including call routing, directory, and telephony control functions.
Exploitation requires that the WebDialer feature be enabled; WebDialer is disabled by default, meaning organizations that have not enabled the click-to-dial feature are not exposed. However, Shadowserver scanning identified more than 200 Cisco Unified CM instances exposed directly to the internet, concentrated in Asia and North America, with no reliable telemetry yet available on how many have applied the fix. CISA added CVE-2026-20230 to its Known Exploited Vulnerabilities (KEV) catalog on or around June 25, 2026 and, per Binding Operational Directive (BOD) 26-04, set an urgent remediation deadline of June 28, 2026 for federal civilian agencies. Cisco confirmed active exploitation on July 2, 2026 and released an updated fix in the September 2026 Cumulative Object Package (COP) for versions 14SU6 and 15SU5.
Because Unified CM is core telephony/UC infrastructure typically deployed on-premises and often internet-facing for remote worker or SIP trunk connectivity, a root-level compromise creates risk of call interception, toll fraud, lateral movement into the broader enterprise voice/video environment, and use of the appliance as a foothold for further network intrusion.
MITRE ATT&CK techniques used in TL-2026-1070
Defense Evasion
Discovery
T1046 Network Service Discovery; T1518 Software Discovery
Execution
T1059 Command and Scripting Interpreter
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
T1071 Application Layer Protocol
Initial Access
T1190 Exploit Public-Facing Application
Lateral Movement
T1210 Exploitation of Remote Services
Impact
persistence
T1505 Server Software Component
Resource Development
Reconnaissance
execution
Affected products and versions in CVE-2026-20230
- Cisco — Unified Communications Manager (Unified CM)
Vulnerable versions: Release 14 (prior to 14SU6); Release 15 (prior to 15SU5)
Fixed in: 14SU6; 15SU5; September 2026 Cumulative Object Package (COP) - Cisco — Unified Communications Manager Session Management Edition (Unified CM SME)
Vulnerable versions: Releases aligned with vulnerable Unified CM versions
Fixed in: Releases aligned with 14SU6/15SU5 fixed Unified CM versions
Remediation for CVE-2026-20230
Patches
- Upgrade to Cisco Unified CM 14SU6 or later
- Upgrade to Cisco Unified CM 15SU5 or later
- Apply corresponding fixed release for Unified CM Session Management Edition (SME)
Immediate actions
- Disable the WebDialer service on all Cisco Unified CM and Unified CM SME instances that do not require click-to-dial functionality
- Remove Unified CM WebDialer/administrative interfaces from direct internet exposure; place behind VPN or restrict via ACLs/firewall
- Audit Unified CM appliances for unauthorized JSP files, unexpected Apache Axis services, or unfamiliar web shells in web-accessible directories
- Review Unified CM and web server access logs for anomalous HTTP requests using file:// URI schemes targeting WebDialer endpoints
- Rotate credentials and review appliance integrity on any Unified CM instance confirmed or suspected exposed to the internet since June 21, 2026
Workarounds
- Disable the WebDialer feature (disabled by default; confirm it remains disabled or disable if previously enabled)
- Restrict network access to Unified CM management and WebDialer interfaces to trusted administrative networks only
Longer-term hardening
- Apply Cisco's September 2026 Cumulative Object Package (COP) fix for 14SU6/15SU5 once validated in a lab environment
- Segment Unified Communications infrastructure from general enterprise networks and the public internet
- Deploy file-integrity monitoring on Unified CM appliances to detect unauthorized file writes
- Establish a routine vulnerability management cadence for Cisco Unified CM given its history of high-impact flaws
CVEs associated with CVE-2026-20230
Weaknesses (CWE) in CVE-2026-20230
CWE-918
Timeline of CVE-2026-20230
- Cisco discloses CVE-2026-20230 and releases patches for Unified CM/Unified CM SME via advisory cisco-sa-cucm-ssrf-cXPnHcW; notes PoC code exists but reports no evidence of active exploitation at that time.
- Threat intelligence firm Defused begins observing active exploitation in the wild over the weekend of June 21-22, 2026, using file:// SSRF payloads against WebDialer.
- Defused publicly reports the observed in-the-wild exploitation activity.
- BleepingComputer reports Cisco Unified CM flaw CVE-2026-20230 now exploited in attacks, citing WebDialer requirement and file:// payload technique.
- SSD Secure publishes a technical writeup and working proof-of-concept exploit; public exploitation reportedly weaponized within 24 hours.
- CISA adds CVE-2026-20230 to its Known Exploited Vulnerabilities (KEV) catalog and, under BOD 26-04, sets a remediation deadline of June 28, 2026 for federal civilian agencies.
- CISA BOD 26-04 remediation deadline for federal civilian agencies to patch or mitigate CVE-2026-20230.
- Shadowserver reports over 200 Cisco Unified CM instances remain exposed directly to the internet, concentrated in Asia and North America.
- Cisco officially confirms active in-the-wild exploitation of CVE-2026-20230 in a public statement.
Sources cited for CVE-2026-20230
- Cisco finally confirms attackers exploiting Unified CM flaw
- Cisco Unified CM flaw CVE-2026-20230 now exploited in attacks
- CISA sets urgent deadline to fix Cisco flaw exploited in attacks
- Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability
- CVE-2026-20230: Cisco Unified Communications Manager SSRF to Remote Code Execution Vulnerability (Actively Exploited) (CISA KEV)
- Cisco Unified Communications Manager SSRF to Root (CVE-2026-20230): Exploit Code Publicly Available, Cisco Rates Critical
- CVE-2026-20230: Cisco Unified CM SSRF
- CVE-2026-20230: Cisco Unified CM WebDialer SSRF Can Lead to Root-Level Compromise
- In Less Than 24 Hours, Attackers Weaponize Cisco CUCM Flaw
- CISA Adds Two Known Exploited Vulnerabilities to Catalog
- Active Exploitation Alert: Cisco CUCM CVE-2026-20230 SSRF-RCE Flaw Weaponized Within 24 Hours of Disclosure
Threats related to CVE-2026-20230
- Fastjson RCE (≤ 1.2.83) — Active Exploitation Detected (ThreatBook XVE-2026-39684)
- CISA KEV: Cisco Unified Communications Manager SSRF to Webshell (CVE-2026-20230) Actively Exploited
- Pwn2Own Berlin 2026 Day Three: Zero-Days Demonstrated in VMware ESXi, Microsoft SharePoint, Windows 11, Red Hat Linux, and Anthropic Claude Code
- CVE-2026-20251: Splunk Secure Gateway jsonpickle Deserialization RCE with Public PoC
- CVE-2026-20230: Cisco Unified Communications Manager WebDialer SSRF Actively Exploited to Drop Tor-Routed JSP Webshells via Rogue Apache Axis Service, CISA Sets June 28 Deadline
- Pwn2Own Berlin 2026 Day Two: Microsoft Exchange RCE-as-SYSTEM Chain and 14 Other Zero-Days Disclosed
Detection coverage for TL-2026-1070
As of 2026-07-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1070 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.