Cisco Unified CM / Unified CM SME SSRF Vulnerability (CVE-2026-20230) — WebDialer File-Write to Root, Actively Exploited, Added to CISA KEV

Cisco Unified CM / Unified CM SME SSRF Vulnerability (TL-2026-1243) is a critical-severity software vulnerability scored CVSS 8.6, first published 2026-07-11. It has no confirmed attribution, affects Cisco Unified Communications Manager (Unified CM), references 1 CVE (CVE-2026-20230), maps to 18 MITRE ATT&CK techniques (T1005, T1016, T1068), and is covered by 9 detection rules and 23 indicators of compromise.

Key facts for TL-2026-1243

Threat ID
TL-2026-1243
Severity
CRITICAL
CVSS
8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-11
Last reviewed
2026-07-11
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
telecoms, government administration, finance, health, technology, enterprise unified communications
Target regions
North America, Global
Detection rules
9
Indicators of compromise
23

Malware and tooling in Cisco Unified CM / Unified CM SME SSRF Vulnerability

Malware and tooling: JSP Stage-1 file-writer webshell, JSP Stage-2 persistent webshell, Apache Axis (abused legitimate component)

An unauthenticated, remote server-side request forgery (SSRF) vulnerability (CWE-918) in the WebDialer service of Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME) allows attackers to write arbitrary files to the underlying operating system via file:// URIs, enabling escalation to root-level code execution. CISA added the flaw to its Known Exploited Vulnerabilities catalog on June 25, 2026 after threat-intel firm Defused observed a single-source actor sending file-write payloads against decoy systems, and set a federal remediation deadline of June 28, 2026 under BOD 26-04.

How Cisco Unified CM / Unified CM SME SSRF Vulnerability works

CVE-2026-20230 is a critical improper-input-validation flaw (CWE-918, Server-Side Request Forgery) in the WebDialer component of Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME). WebDialer accepts user-supplied URL parameters without adequately validating the target scheme or destination, allowing an unauthenticated, remote attacker to submit crafted HTTP requests that force the server to fetch or write attacker-controlled file:// URIs. The resulting arbitrary file write on the underlying Linux-based appliance OS gives an attacker a foothold from which to place files in web-service-writable or cron/init-consulted paths, ultimately achieving root-level code execution on the appliance — a full compromise of a call-control/voice-signaling core with no authentication required.

Exploitation is a multi-stage chain corroborated by independent technical writeups (denizhalil.com, Rescana, LatestHackingNews). Reconnaissance begins with an unauthenticated query to the WebDialer SOAP/WSDL endpoint (`/webdialer/Version.jws?wsdl`) to retrieve the target appliance's true short hostname — a prerequisite for bypassing SSRF host-header/allowlist validation on subsequent requests. The attacker then targets the `/cmplatform/installClusterStatusExecute` endpoint, injecting a malicious value into the hostname parameter that uses `../` directory-traversal sequences combined with a `file://` URI to write a rogue Apache Axis Web Services Deployment Descriptor (WSDD) into a web-accessible directory. Once registered, the malicious Axis service is invoked to write a minimal JSP-based Stage-1 file-writer webshell to disk; that Stage-1 webshell is in turn used to write a more capable, persistent Stage-2 webshell into the `/platform-services/axis2-web/` directory, which is externally reachable via the appliance's web interface. Observed automated exploitation attempted access to deployed webshells using a `pwd=123` authentication/parameter convention, consistent with a common public webshell template rather than bespoke tooling. Because the write occurs in a service context with elevated privileges, this file-write primitive is chained to root-level command execution. Cisco assigned this the Security Impact Rating of Critical (above what the CVSS base score of 8.6 alone would suggest) specifically because of the root privilege-escalation potential.

Exploitation requires the WebDialer service to be enabled; it is disabled by default, which somewhat limits the exposed population to Unified CM/SME deployments that have explicitly turned on click-to-dial functionality — commonly enterprise and telecom environments with browser or CRM-integrated dialing. The Shadowserver Foundation's internet-wide scanning identified over 200 exposed Cisco Unified CM instances reachable from the public internet at the time of disclosure. Cisco published the fixed-release advisory cisco-sa-cucm-ssrf-cXPnHcW on 2026-06-03. Public proof-of-concept exploit code became available around 2026-06-05, and a third-party technical writeup (denizhalil.com) detailing the SSRF-to-file-write-to-root mechanics was published 2026-06-12. Threat-intel firm Defused first observed genuine in-the-wild exploitation attempts around 2026-06-21/22, describing a single source IP sending well-formed file:// file-write payloads against decoy (honeypot) Unified CM instances — consistent with mass internet scanning/reconnaissance using an "unvetted" public PoC rather than a bespoke or targeted operation. The observed payloads attempted to write an innocuous test file (e.g. /tmp/cve-2026-20230-test.txt) to fingerprint vulnerable, internet-exposed systems ahead of further exploitation; follow-on activity progressed to automated webshell drops via the Axis/WSDD chain described above. Reporting from LatestHackingNews and Rescana indicates the scanning/exploitation campaign routed its traffic through the Tor anonymizing network to mask attacker source infrastructure, consistent with opportunistic mass exploitation rather than a targeted, attributable intrusion. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on 2026-06-25 and, per Binding Operational Directive (BOD) 26-04, gave U.S. federal civilian agencies until 2026-06-28 to remediate — an unusually short three-day window reflecting the severity of unauthenticated root compromise on VoIP call-control infrastructure. Cisco itself did not initially confirm active exploitation publicly; outlets including BleepingComputer sought confirmation and IOCs directly from Cisco PSIRT. Cisco later (around 2026-07-01) acknowledged awareness of exploitation reported the prior month.

Unified CM and Unified CM SME sit at the center of enterprise voice/video call routing and session management, making them high-value targets: compromise can enable call interception, toll fraud, lateral movement into the broader UC estate, and disruption of emergency/PSAP-adjacent communications in some deployments. Because WebDialer-enabled instances are frequently reachable from internal corporate networks and, in some misconfigured deployments, from the internet for remote/softphone click-to-dial, the unauthenticated nature of the flaw is especially dangerous. Defenders should treat any Unified CM/SME appliance with WebDialer enabled as an urgent patch priority, audit `/platform-services/axis2-web/` and `/tmp/` for unexpected `.jsp` files or writes, review WebDialer and `cmplatform` access logs for requests to `installClusterStatusExecute` containing path-traversal sequences or `pwd=123`-style webshell probes, block known Tor exit-node egress where feasible, and disable WebDialer where the feature is not operationally required.

MITRE ATT&CK techniques used in TL-2026-1243

Collection

T1005 Data from Local System

Discovery

T1016 System Network Configuration Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism

command-and-control

T1090.003 Multi-hop Proxy

Command and Control

T1105 Ingress Tool Transfer

Initial Access

T1190 Exploit Public-Facing Application

Execution

T1203 Exploitation for Client Execution

Defense Evasion

T1211 Exploitation for Stealth

defense-impairment

T1222 File and Directory Permissions Modification

persistence

T1505 Server Software Component

Persistence

T1505.003 Web Shell

Impact

T1565.001 Stored Data Manipulation

Resource Development

T1588.005 Exploits

Reconnaissance

T1592.002 Software; T1595.002 Vulnerability Scanning

Affected products and versions in Cisco Unified CM / Unified CM SME SSRF Vulnerability

  • Cisco — Unified Communications Manager (Unified CM)
    Vulnerable versions: 14.0 through pre-14SU6; 15.0 through 15SU4a
    Fixed in: 14SU6; 15SU5
  • Cisco — Unified Communications Manager Session Management Edition (Unified CM SME)
    Vulnerable versions: 14.0 through pre-14SU6; 15.0 through 15SU4a
    Fixed in: 14SU6; 15SU5

Remediation for Cisco Unified CM / Unified CM SME SSRF Vulnerability

Patches

  • Cisco Unified CM 14SU6 or later (fixes versions 14.0 through pre-14SU6)
  • Cisco Unified CM 15SU5 or later (fixes versions 15.0 through 15SU4a)
  • Corresponding fixed releases for Cisco Unified CM Session Management Edition (SME)

Immediate actions

  • Apply Cisco security advisory cisco-sa-cucm-ssrf-cXPnHcW patches (available since 2026-06-03) to Unified CM and Unified CM SME appliances immediately
  • Disable the WebDialer service on any Unified CM/SME cluster where click-to-dial functionality is not operationally required
  • Audit WebDialer and cmplatform access logs and filesystem-write events (especially in /tmp and /platform-services/axis2-web/) for anomalous activity predating patch deployment, including requests to installClusterStatusExecute with path-traversal sequences or pwd=123-style webshell probes
  • Restrict network exposure of Unified CM/SME administrative and WebDialer interfaces to trusted internal networks only; remove any direct internet exposure
  • Inspect for and remove any unauthorized .jsp files or rogue Apache Axis WSDD service registrations discovered on affected appliances

Workarounds

  • Disable WebDialer service (feature is disabled by default; do not enable unless required)
  • If WebDialer must remain enabled, restrict access via network ACLs/firewall rules to only trusted management or client subnets

Longer-term hardening

  • Deploy network segmentation isolating UC/voice infrastructure from general corporate and internet-facing network segments
  • Implement continuous vulnerability scanning and KEV-catalog monitoring for all Cisco Unified Communications infrastructure
  • Establish an accelerated patch SLA for internet-reachable or otherwise high-exposure UC appliances consistent with CISA BOD 26-04 timelines
  • Deploy egress filtering / URL-scheme allowlisting on services that accept user-supplied URLs to blunt future SSRF-class flaws
  • Consider blocking or alerting on Tor exit-node traffic reaching UC/voice-management interfaces

CVEs associated with Cisco Unified CM / Unified CM SME SSRF Vulnerability

CVE-2026-20230

Weaknesses (CWE) in Cisco Unified CM / Unified CM SME SSRF Vulnerability

CWE-918

Timeline of Cisco Unified CM / Unified CM SME SSRF Vulnerability

  • Cisco publishes security advisory cisco-sa-cucm-ssrf-cXPnHcW disclosing CVE-2026-20230 and releasing fixed Unified CM 14SU6 / 15SU5 releases.
  • TechTimes reports public exploit code opening a path from SSRF to root, drawing early security-media attention to the flaw.
  • Public proof-of-concept exploit code for CVE-2026-20230 becomes available, describing the WebDialer file:// arbitrary file-write chain to root.
  • Rescana reports the flaw weaponized within 24 hours of disclosure, elevating urgency of the exposure.
  • Third-party technical writeup of CVE-2026-20230 published (denizhalil.com), detailing the SSRF-to-file-write mechanics including the WebDialer WSDL hostname-recon step and the cmplatform installClusterStatusExecute path-traversal/file-write primitive.
  • Threat-intel firm Defused first observes in-the-wild exploitation attempts against decoy Unified CM systems from a single source IP using the public PoC.
  • Automated exploitation activity progresses from test file-writes to dropping JSP-based Stage-1/Stage-2 webshells into /platform-services/axis2-web/ via a rogue Apache Axis WSDD service, per LatestHackingNews and SOCRadar reporting; traffic observed routed through Tor to mask source infrastructure.
  • Defused and SSD Secure Disclosure publish technical detail on active exploitation; BleepingComputer reports the flaw is now being exploited in attacks and seeks Cisco confirmation/IOCs.
  • Threat-Modeling.com and Daily Security Review publish additional technical/impact analysis of active exploitation.
  • CISA adds CVE-2026-20230 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active real-world exploitation and triggering BOD 26-04 remediation requirements.
  • Widespread security-media coverage of the CISA KEV addition and federal remediation deadline (Cyber Security News, TheHackerNews, SecurityWeek).
  • Mandatory remediation deadline for U.S. federal civilian executive branch agencies under CISA BOD 26-04.
  • Cisco acknowledges awareness of active exploitation reported the prior month, following press inquiries requesting confirmation and shareable indicators of compromise.

Sources cited for Cisco Unified CM / Unified CM SME SSRF Vulnerability

Threats related to Cisco Unified CM / Unified CM SME SSRF Vulnerability

Detection coverage for TL-2026-1243

As of 2026-07-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1243 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats