Threat reportVulnerabilityTL-2026-1243
Cisco Unified CM / Unified CM SME SSRF Vulnerability (CVE-2026-20230) — WebDialer File-Write to Root, Actively Exploited, Added to CISA KEV
Cisco Unified CM / Unified CM SME SSRF Vulnerability (TL-2026-1243) is a critical-severity software vulnerability scored CVSS 8.6, first published 2026-07-11. It has no confirmed attribution, affects Cisco Unified Communications Manager (Unified CM), references 1 CVE (CVE-2026-20230), maps to 18 MITRE ATT&CK techniques (T1005, T1016, T1068), and is covered by 9 detection rules and 23 indicators of compromise.
- CVSS
- 8.6/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 18MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 23Indicators of compromise
Key facts for TL-2026-1243
- Threat ID
- TL-2026-1243
- Severity
- CRITICAL
- CVSS
- 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- telecoms, government administration, finance, health, technology, enterprise unified communications
- Target regions
- North America, Global
- Detection rules
- 9
- Indicators of compromise
- 23
Malware and tooling in Cisco Unified CM / Unified CM SME SSRF Vulnerability
Malware and tooling: JSP Stage-1 file-writer webshell, JSP Stage-2 persistent webshell, Apache Axis (abused legitimate component)
How Cisco Unified CM / Unified CM SME SSRF Vulnerability works
An unauthenticated, remote server-side request forgery (SSRF) vulnerability (CWE-918) in the WebDialer service of Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME) allows attackers to write arbitrary files to the underlying operating system via file:// URIs, enabling escalation to root-level code execution. CISA added the flaw to its Known Exploited Vulnerabilities catalog on June 25, 2026 after threat-intel firm Defused observed a single-source actor sending file-write payloads against decoy systems, and set a federal remediation deadline of June 28, 2026 under BOD 26-04.
CVE-2026-20230 is a critical improper-input-validation flaw (CWE-918, Server-Side Request Forgery) in the WebDialer component of Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME). WebDialer accepts user-supplied URL parameters without adequately validating the target scheme or destination, allowing an unauthenticated, remote attacker to submit crafted HTTP requests that force the server to fetch or write attacker-controlled file:// URIs. The resulting arbitrary file write on the underlying Linux-based appliance OS gives an attacker a foothold from which to place files in web-service-writable or cron/init-consulted paths, ultimately achieving root-level code execution on the appliance — a full compromise of a call-control/voice-signaling core with no authentication required.
Exploitation is a multi-stage chain corroborated by independent technical writeups (denizhalil.com, Rescana, LatestHackingNews). Reconnaissance begins with an unauthenticated query to the WebDialer SOAP/WSDL endpoint (`/webdialer/Version.jws?wsdl`) to retrieve the target appliance's true short hostname — a prerequisite for bypassing SSRF host-header/allowlist validation on subsequent requests. The attacker then targets the `/cmplatform/installClusterStatusExecute` endpoint, injecting a malicious value into the hostname parameter that uses `../` directory-traversal sequences combined with a `file://` URI to write a rogue Apache Axis Web Services Deployment Descriptor (WSDD) into a web-accessible directory. Once registered, the malicious Axis service is invoked to write a minimal JSP-based Stage-1 file-writer webshell to disk; that Stage-1 webshell is in turn used to write a more capable, persistent Stage-2 webshell into the `/platform-services/axis2-web/` directory, which is externally reachable via the appliance's web interface. Observed automated exploitation attempted access to deployed webshells using a `pwd=123` authentication/parameter convention, consistent with a common public webshell template rather than bespoke tooling. Because the write occurs in a service context with elevated privileges, this file-write primitive is chained to root-level command execution. Cisco assigned this the Security Impact Rating of Critical (above what the CVSS base score of 8.6 alone would suggest) specifically because of the root privilege-escalation potential.
Exploitation requires the WebDialer service to be enabled; it is disabled by default, which somewhat limits the exposed population to Unified CM/SME deployments that have explicitly turned on click-to-dial functionality — commonly enterprise and telecom environments with browser or CRM-integrated dialing. The Shadowserver Foundation's internet-wide scanning identified over 200 exposed Cisco Unified CM instances reachable from the public internet at the time of disclosure. Cisco published the fixed-release advisory cisco-sa-cucm-ssrf-cXPnHcW on 2026-06-03. Public proof-of-concept exploit code became available around 2026-06-05, and a third-party technical writeup (denizhalil.com) detailing the SSRF-to-file-write-to-root mechanics was published 2026-06-12. Threat-intel firm Defused first observed genuine in-the-wild exploitation attempts around 2026-06-21/22, describing a single source IP sending well-formed file:// file-write payloads against decoy (honeypot) Unified CM instances — consistent with mass internet scanning/reconnaissance using an "unvetted" public PoC rather than a bespoke or targeted operation. The observed payloads attempted to write an innocuous test file (e.g. /tmp/cve-2026-20230-test.txt) to fingerprint vulnerable, internet-exposed systems ahead of further exploitation; follow-on activity progressed to automated webshell drops via the Axis/WSDD chain described above. Reporting from LatestHackingNews and Rescana indicates the scanning/exploitation campaign routed its traffic through the Tor anonymizing network to mask attacker source infrastructure, consistent with opportunistic mass exploitation rather than a targeted, attributable intrusion. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on 2026-06-25 and, per Binding Operational Directive (BOD) 26-04, gave U.S. federal civilian agencies until 2026-06-28 to remediate — an unusually short three-day window reflecting the severity of unauthenticated root compromise on VoIP call-control infrastructure. Cisco itself did not initially confirm active exploitation publicly; outlets including BleepingComputer sought confirmation and IOCs directly from Cisco PSIRT. Cisco later (around 2026-07-01) acknowledged awareness of exploitation reported the prior month.
Unified CM and Unified CM SME sit at the center of enterprise voice/video call routing and session management, making them high-value targets: compromise can enable call interception, toll fraud, lateral movement into the broader UC estate, and disruption of emergency/PSAP-adjacent communications in some deployments. Because WebDialer-enabled instances are frequently reachable from internal corporate networks and, in some misconfigured deployments, from the internet for remote/softphone click-to-dial, the unauthenticated nature of the flaw is especially dangerous. Defenders should treat any Unified CM/SME appliance with WebDialer enabled as an urgent patch priority, audit `/platform-services/axis2-web/` and `/tmp/` for unexpected `.jsp` files or writes, review WebDialer and `cmplatform` access logs for requests to `installClusterStatusExecute` containing path-traversal sequences or `pwd=123`-style webshell probes, block known Tor exit-node egress where feasible, and disable WebDialer where the feature is not operationally required.
MITRE ATT&CK techniques used in TL-2026-1243
Collection
Discovery
T1016 System Network Configuration Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism
command-and-control
Command and Control
Initial Access
T1190 Exploit Public-Facing Application
Execution
T1203 Exploitation for Client Execution
Defense Evasion
T1211 Exploitation for Stealth
defense-impairment
T1222 File and Directory Permissions Modification
persistence
T1505 Server Software Component
Persistence
Impact
T1565.001 Stored Data Manipulation
Resource Development
Reconnaissance
Affected products and versions in Cisco Unified CM / Unified CM SME SSRF Vulnerability
- Cisco — Unified Communications Manager (Unified CM)
Vulnerable versions: 14.0 through pre-14SU6; 15.0 through 15SU4a
Fixed in: 14SU6; 15SU5 - Cisco — Unified Communications Manager Session Management Edition (Unified CM SME)
Vulnerable versions: 14.0 through pre-14SU6; 15.0 through 15SU4a
Fixed in: 14SU6; 15SU5
Remediation for Cisco Unified CM / Unified CM SME SSRF Vulnerability
Patches
- Cisco Unified CM 14SU6 or later (fixes versions 14.0 through pre-14SU6)
- Cisco Unified CM 15SU5 or later (fixes versions 15.0 through 15SU4a)
- Corresponding fixed releases for Cisco Unified CM Session Management Edition (SME)
Immediate actions
- Apply Cisco security advisory cisco-sa-cucm-ssrf-cXPnHcW patches (available since 2026-06-03) to Unified CM and Unified CM SME appliances immediately
- Disable the WebDialer service on any Unified CM/SME cluster where click-to-dial functionality is not operationally required
- Audit WebDialer and cmplatform access logs and filesystem-write events (especially in /tmp and /platform-services/axis2-web/) for anomalous activity predating patch deployment, including requests to installClusterStatusExecute with path-traversal sequences or pwd=123-style webshell probes
- Restrict network exposure of Unified CM/SME administrative and WebDialer interfaces to trusted internal networks only; remove any direct internet exposure
- Inspect for and remove any unauthorized .jsp files or rogue Apache Axis WSDD service registrations discovered on affected appliances
Workarounds
- Disable WebDialer service (feature is disabled by default; do not enable unless required)
- If WebDialer must remain enabled, restrict access via network ACLs/firewall rules to only trusted management or client subnets
Longer-term hardening
- Deploy network segmentation isolating UC/voice infrastructure from general corporate and internet-facing network segments
- Implement continuous vulnerability scanning and KEV-catalog monitoring for all Cisco Unified Communications infrastructure
- Establish an accelerated patch SLA for internet-reachable or otherwise high-exposure UC appliances consistent with CISA BOD 26-04 timelines
- Deploy egress filtering / URL-scheme allowlisting on services that accept user-supplied URLs to blunt future SSRF-class flaws
- Consider blocking or alerting on Tor exit-node traffic reaching UC/voice-management interfaces
CVEs associated with Cisco Unified CM / Unified CM SME SSRF Vulnerability
Weaknesses (CWE) in Cisco Unified CM / Unified CM SME SSRF Vulnerability
Timeline of Cisco Unified CM / Unified CM SME SSRF Vulnerability
- Cisco publishes security advisory cisco-sa-cucm-ssrf-cXPnHcW disclosing CVE-2026-20230 and releasing fixed Unified CM 14SU6 / 15SU5 releases.
- TechTimes reports public exploit code opening a path from SSRF to root, drawing early security-media attention to the flaw.
- Public proof-of-concept exploit code for CVE-2026-20230 becomes available, describing the WebDialer file:// arbitrary file-write chain to root.
- Rescana reports the flaw weaponized within 24 hours of disclosure, elevating urgency of the exposure.
- Third-party technical writeup of CVE-2026-20230 published (denizhalil.com), detailing the SSRF-to-file-write mechanics including the WebDialer WSDL hostname-recon step and the cmplatform installClusterStatusExecute path-traversal/file-write primitive.
- Threat-intel firm Defused first observes in-the-wild exploitation attempts against decoy Unified CM systems from a single source IP using the public PoC.
- Automated exploitation activity progresses from test file-writes to dropping JSP-based Stage-1/Stage-2 webshells into /platform-services/axis2-web/ via a rogue Apache Axis WSDD service, per LatestHackingNews and SOCRadar reporting; traffic observed routed through Tor to mask source infrastructure.
- Defused and SSD Secure Disclosure publish technical detail on active exploitation; BleepingComputer reports the flaw is now being exploited in attacks and seeks Cisco confirmation/IOCs.
- Threat-Modeling.com and Daily Security Review publish additional technical/impact analysis of active exploitation.
- CISA adds CVE-2026-20230 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active real-world exploitation and triggering BOD 26-04 remediation requirements.
- Widespread security-media coverage of the CISA KEV addition and federal remediation deadline (Cyber Security News, TheHackerNews, SecurityWeek).
- Mandatory remediation deadline for U.S. federal civilian executive branch agencies under CISA BOD 26-04.
- Cisco acknowledges awareness of active exploitation reported the prior month, following press inquiries requesting confirmation and shareable indicators of compromise.
Sources cited for Cisco Unified CM / Unified CM SME SSRF Vulnerability
- Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability (cisco-sa-cucm-ssrf-cXPnHcW)
- Cisco Unified CM vulnerability news coverage
- CVE-2026-20230: Cisco Unified CM SSRF — Horizon3.ai Attack Research
- CVE-2026-20230: Cisco Unified Communications Manager SSRF to Remote Code Execution Vulnerability
- CISA sets urgent deadline to fix Cisco flaw exploited in attacks
- CISA Adds Two Known Exploited Vulnerabilities to Catalog
- Cisco Unified CM SME flaw CVE-2026-20230 now exploited in attacks
- CVE-2026-20230 Detail — NVD
- Cisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to Root
- Hackers Exploiting Cisco Unified CM Vulnerability
- Cisco finally confirms attackers exploiting Unified CM flaw
- CISA Known Exploited Vulnerabilities Catalog entry — CVE-2026-20230
- CVE-2026-20230: Cisco Unified CM SSRF & Root Exploit Analysis — denizhalil.com
- CVE-2026-20230: Cisco Unified CM WebDialer SSRF Can Lead to Root-Level Compromise — SOCRadar
- Active Exploitation Alert: Cisco CUCM CVE-2026-20230 SSRF-RCE Flaw Weaponized Within 24 Hours of Disclosure — Rescana
Detection coverage for TL-2026-1243
As of 2026-07-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1243 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.