# CVE-2026-20230: Active Exploitation of Cisco Unified CM WebDialer SSRF Flaw Leading to Root-Level Compromise

> Cisco confirmed on July 2, 2026 active in-the-wild exploitation of CVE-2026-20230, a CVSS 8.6 unauthenticated SSRF vulnerability in the WebDialer service of Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition. Threat intelligence firm Defused first observed file:// SSRF payloads being used to write files to the underlying OS starting June 21-22, 2026, with the attack chain culminating in root-level compromise via a rogue Apache Axis service and staged JSP web shells.

- **Published:** 2026-07-02T00:00:00Z
- **Last reviewed:** 2026-07-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1070
- **ID:** TL-2026-1070
- **Severity:** HIGH (CVSS 8.6)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-20230

## Description

CVE-2026-20230 is a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) in the WebDialer service of Cisco Unified Communications Manager (Unified CM, formerly CallManager) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME). The flaw stems from improper input validation of specific HTTP requests processed by WebDialer, allowing an unauthenticated, remote attacker to submit crafted HTTP requests that force the application to make unintended server-side requests. When WebDialer accepts file:// scheme payloads, an attacker can coerce the application into writing arbitrary files to the underlying operating system.

Cisco publicly disclosed and patched the vulnerability on June 3, 2026 (advisory cisco-sa-cucm-ssrf-cXPnHcW), at the time noting that proof-of-concept code existed but stating it had no evidence of active exploitation. Within roughly three weeks, threat intelligence firm Defused observed the vulnerability being actively exploited in the wild beginning the weekend of June 21-22, 2026, using file:// SSRF payloads to plant files on targeted Unified CM appliances. Independent researchers at SSD Secure published a technical writeup and working PoC on June 23, 2026, and public exploitation was reportedly weaponized within 24 hours of the technical details becoming available.

The observed attack chain begins with the unauthenticated SSRF against the WebDialer endpoint, which is used to deploy a rogue Apache Axis service on the appliance. That rogue Axis service is then abused to write a first-stage JSP file-writer web shell to a web-accessible directory, which in turn is used to drop a second-stage command-execution shell, giving the attacker persistent remote code execution. Cisco assessed the overall impact as Critical (despite the CVSS base score of 8.6, which nominally maps to High) because successful exploitation can be leveraged to elevate privileges to root on the underlying appliance operating system, resulting in complete compromise of the Unified CM instance including call routing, directory, and telephony control functions.

Exploitation requires that the WebDialer feature be enabled; WebDialer is disabled by default, meaning organizations that have not enabled the click-to-dial feature are not exposed. However, Shadowserver scanning identified more than 200 Cisco Unified CM instances exposed directly to the internet, concentrated in Asia and North America, with no reliable telemetry yet available on how many have applied the fix. CISA added CVE-2026-20230 to its Known Exploited Vulnerabilities (KEV) catalog on or around June 25, 2026 and, per Binding Operational Directive (BOD) 26-04, set an urgent remediation deadline of June 28, 2026 for federal civilian agencies. Cisco confirmed active exploitation on July 2, 2026 and released an updated fix in the September 2026 Cumulative Object Package (COP) for versions 14SU6 and 15SU5.

Because Unified CM is core telephony/UC infrastructure typically deployed on-premises and often internet-facing for remote worker or SIP trunk connectivity, a root-level compromise creates risk of call interception, toll fraud, lateral movement into the broader enterprise voice/video environment, and use of the appliance as a foothold for further network intrusion.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1505 Server Software Component
- T1059 Command and Scripting Interpreter
- T1068 Exploitation for Privilege Escalation
- T1036 Masquerading
- T1610 Deploy Container
- T1046 Network Service Discovery
- T1518 Software Discovery
- T1210 Exploitation of Remote Services
- T1071 Application Layer Protocol
- T1489 Service Stop
- T1595 Active Scanning
- T1587 Develop Capabilities

## Sources

- [Cisco finally confirms attackers exploiting Unified CM flaw](https://www.bleepingcomputer.com/news/security/cisco-finally-confirms-attackers-exploiting-unified-cm-flaw/)
- [Cisco Unified CM flaw CVE-2026-20230 now exploited in attacks](https://www.bleepingcomputer.com/news/security/cisco-unified-cm-sme-flaw-cve-2026-20230-now-exploited-in-attacks/)
- [CISA sets urgent deadline to fix Cisco flaw exploited in attacks](https://www.bleepingcomputer.com/news/security/cisa-sets-urgent-deadline-to-fix-cisco-flaw-exploited-in-attacks/)
- [Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability](https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-cucm-ssrf-cXPnHcW.html)
- [CVE-2026-20230: Cisco Unified Communications Manager SSRF to Remote Code Execution Vulnerability (Actively Exploited) (CISA KEV)](https://threat-modeling.com/cve-2026-20230-cisco-unified-communications-manager-ssrf-rce/)
- [Cisco Unified Communications Manager SSRF to Root (CVE-2026-20230): Exploit Code Publicly Available, Cisco Rates Critical](https://threat-modeling.com/cisco-unified-cm-ssrf-root-cve-2026-20230/)
- [CVE-2026-20230: Cisco Unified CM SSRF](https://horizon3.ai/attack-research/vulnerabilities/cve-2026-20230/)
- [CVE-2026-20230: Cisco Unified CM WebDialer SSRF Can Lead to Root-Level Compromise](https://socradar.io/blog/cve-2026-20230-cisco-unified-cm-webdialer-ssrf/)
- [In Less Than 24 Hours, Attackers Weaponize Cisco CUCM Flaw](https://www.darkreading.com/cyberattacks-data-breaches/less-than-24-hours-attackers-weaponize-cisco-cucm-flaw)
- [CISA Adds Two Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/06/25/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [Active Exploitation Alert: Cisco CUCM CVE-2026-20230 SSRF-RCE Flaw Weaponized Within 24 Hours of Disclosure](https://www.rescana.com/post/active-exploitation-alert-cisco-cucm-cve-2026-20230-ssrf-rce-flaw-weaponized-within-24-hours-of-disclosure)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1070