# CVE-2026-20230: Cisco Unified Communications Manager WebDialer SSRF Actively Exploited to Drop Tor-Routed JSP Webshells via Rogue Apache Axis Service, CISA Sets June 28 Deadline

> CISA added CVE-2026-20230, a critical unauthenticated SSRF vulnerability in Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME), to its Known Exploited Vulnerabilities catalog after security firm Defused observed active exploitation. Attackers abuse the WebDialer service to force an internal-proxy trust bypass, first fingerprinting targets with simple file writes and then escalating to automated Tor-routed sweeps that deploy a rogue Apache Axis service and drop three-stage JSP command-execution webshells under /platform-services/axis2-web/, a path that can be leveraged toward root-level compromise via cron/startup mechanisms. Federal agencies face a June 28, 2026 remediation deadline under BOD 26-04; the responsible threat actor is unknown, and Shadowserver tracks 200+ internet-exposed Unified CM instances.

- **Published:** 2026-07-11T00:00:00Z
- **Last reviewed:** 2026-07-11T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1236
- **ID:** TL-2026-1236
- **Severity:** CRITICAL (CVSS 8.6)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-20230

## Description

CVE-2026-20230 is a CVSS 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) server-side request forgery vulnerability (CWE-918) in the WebDialer web service component of Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME), also affecting legacy CallManager deployments carrying the same code lineage. Improper validation of specific HTTP request parameters allows an unauthenticated, remote attacker to force the WebDialer application to act as an internal proxy, issuing requests to loopback (127.0.0.1) interfaces and internal IPC sockets that implicitly trust local-origin traffic. By chaining this trust-boundary bypass with access to internal administrative APIs, the attacker can write arbitrary text and file:// payloads to sensitive filesystem locations, including system initialization directories and cron.d job directories. Because cron and startup scripts execute automatically with root privileges, a maliciously placed file in these locations provides a path to full root-level compromise. Exploitation requires the WebDialer service to be enabled; it is disabled by default, which limits exposure to organizations that have activated the feature for click-to-dial functionality.

Cisco patched the flaw on June 3, 2026 with a public PoC exploit surfacing within 24-48 hours (June 4-5, 2026) and no evidence of in-the-wild exploitation at disclosure time. Threat detection firm Defused subsequently observed real-world exploitation beginning the weekend of June 21-22, 2026, describing early activity as originating 'from a single source using an unvetted PoC, with genuinely-formatted file:// file-write payloads landing on our decoys' — payloads consistent with the publicly leaked PoC rather than a bespoke, more sophisticated exploit, used initially to fingerprint vulnerable devices by writing a test file such as /tmp/cve-2026-20230-test.txt. By June 24, 2026, Defused and independent researchers (including SSD Secure, which published its own technical PoC write-up on June 23, 2026) documented an escalation: automated, Tor-routed reconnaissance sweeps that abuse the WebDialer SSRF to deploy a rogue Apache Axis service, which is then used to write a second-stage JSP command-execution webshell to disk under the /platform-services/axis2-web/ directory — a three-stage chain (SSRF trigger -> rogue Axis service deployment -> JSP webshell drop) that grants attackers persistent remote command execution independent of the original SSRF vector and that a vendor patch alone does not evict once deployed.

CISA added the CVE to its Known Exploited Vulnerabilities catalog on June 25, 2026, and — citing Binding Operational Directive BOD 26-04 (Prioritizing Security Updates Based on Risk) — set a June 28, 2026 remediation deadline for federal civilian agencies, requiring patching, mitigation, or discontinued use of the product. Cisco updated its advisory on July 1-2, 2026 to formally confirm active exploitation. Shadowserver telemetry reports over 200 Cisco Unified CM instances directly exposed to the internet, concentrated in Asia and North America, underscoring a substantial unauthenticated attack surface. Public offensive tooling proliferated quickly: the HalilDeniz/CVE-2026-20230-Scanner and HORKimhab/CVE-2026-20230 GitHub repositories both provide validation/exploitation scripts, and Horizon3.ai's NodeZero Rapid Response module offers automated safe verification for defenders. The unauthenticated network attack vector, absence of user interaction, critical infrastructure use case (unified communications/VoIP), webshell persistence independent of the initial vulnerability, and existence of multiple public, weaponized PoCs make this a high-priority remediation and incident-response target for any organization running affected Unified CM/SME deployments with WebDialer enabled — patching alone does not remove webshells already dropped, so post-compromise forensic review is required even after upgrading.

## MITRE ATT&CK

- T1595 Active Scanning
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1505 Server Software Component
- T1053 Scheduled Task/Job
- T1548 Abuse Elevation Control Mechanism
- T1090 Proxy
- T1036 Masquerading
- T1082 System Information Discovery
- T1021 Remote Services
- T1090 Proxy
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer

## Sources

- [CISA Sets Urgent Deadline to Fix Cisco Flaw Exploited in Attacks](https://www.bleepingcomputer.com/news/security/cisa-sets-urgent-deadline-to-fix-cisco-flaw-exploited-in-attacks/)
- [Cisco warns of critical Unified CM flaw with PoC exploit code](https://www.bleepingcomputer.com/news/security/cisco-warns-of-critical-unified-cm-flaw-with-poc-exploit-code/)
- [Cisco Unified CM SME flaw CVE-2026-20230 now exploited in attacks](https://www.bleepingcomputer.com/news/security/cisco-unified-cm-sme-flaw-cve-2026-20230-now-exploited-in-attacks/)
- [Cisco finally confirms attackers exploiting Unified CM flaw](https://www.bleepingcomputer.com/news/security/cisco-finally-confirms-attackers-exploiting-unified-cm-flaw/)
- [Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability](https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-cucm-ssrf-cXPnHcW.html)
- [Cisco Security Advisory (cisco-sa-cucm-ssrf-cXPnHcW)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW)
- [CVE-2026-20230 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-20230)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20230)
- [CVE-2026-20230 Cisco Unified CM SSRF - Exploit Chain Analysis](https://denizhalil.com/2026/06/12/cve-2026-20230-cisco-unified-cm-ssrf/)
- [CVE-2026-20230: Cisco Unified CM SSRF | Horizon3.ai Attack Research](https://horizon3.ai/attack-research/vulnerabilities/cve-2026-20230/)
- [Cisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to Root](https://thehackernews.com/2026/06/cisco-unified-cm-flaw-exploited-after.html)
- [Cisco Unified CM flaw actively exploited to drop webshells (CVE-2026-20230)](https://www.helpnetsecurity.com/2026/06/24/cisco-unified-cm-flaw-exploited-to-drop-webshells-cve-2026-20230/)
- [Cisco Unified CM CVE-2026-20230: Webshell Drops Confirmed, Patch Alone Won't Evict Attackers](https://www.techtimes.com/articles/319023/20260624/cisco-unified-cm-cve-2026-20230-webshell-drops-confirmed-patch-alone-wont-evict-attackers.htm)
- [Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public](https://thehackernews.com/2026/06/cisco-patches-cve-2026-20230-in-unified.html)
- [GitHub - HalilDeniz/CVE-2026-20230-Scanner](https://github.com/HalilDeniz/CVE-2026-20230-Scanner)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1236