# Cisco Unified CM / Unified CM SME SSRF Vulnerability (CVE-2026-20230) — WebDialer File-Write to Root, Actively Exploited, Added to CISA KEV

> An unauthenticated, remote server-side request forgery (SSRF) vulnerability (CWE-918) in the WebDialer service of Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME) allows attackers to write arbitrary files to the underlying operating system via file:// URIs, enabling escalation to root-level code execution. CISA added the flaw to its Known Exploited Vulnerabilities catalog on June 25, 2026 after threat-intel firm Defused observed a single-source actor sending file-write payloads against decoy systems, and set a federal remediation deadline of June 28, 2026 under BOD 26-04.

- **Published:** 2026-07-11T00:00:00Z
- **Last reviewed:** 2026-07-11T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1243
- **ID:** TL-2026-1243
- **Severity:** CRITICAL (CVSS 8.6)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-20230

## Description

CVE-2026-20230 is a critical improper-input-validation flaw (CWE-918, Server-Side Request Forgery) in the WebDialer component of Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME). WebDialer accepts user-supplied URL parameters without adequately validating the target scheme or destination, allowing an unauthenticated, remote attacker to submit crafted HTTP requests that force the server to fetch or write attacker-controlled file:// URIs. The resulting arbitrary file write on the underlying Linux-based appliance OS gives an attacker a foothold from which to place files in web-service-writable or cron/init-consulted paths, ultimately achieving root-level code execution on the appliance — a full compromise of a call-control/voice-signaling core with no authentication required.

Exploitation is a multi-stage chain corroborated by independent technical writeups (denizhalil.com, Rescana, LatestHackingNews). Reconnaissance begins with an unauthenticated query to the WebDialer SOAP/WSDL endpoint (`/webdialer/Version.jws?wsdl`) to retrieve the target appliance's true short hostname — a prerequisite for bypassing SSRF host-header/allowlist validation on subsequent requests. The attacker then targets the `/cmplatform/installClusterStatusExecute` endpoint, injecting a malicious value into the hostname parameter that uses `../` directory-traversal sequences combined with a `file://` URI to write a rogue Apache Axis Web Services Deployment Descriptor (WSDD) into a web-accessible directory. Once registered, the malicious Axis service is invoked to write a minimal JSP-based Stage-1 file-writer webshell to disk; that Stage-1 webshell is in turn used to write a more capable, persistent Stage-2 webshell into the `/platform-services/axis2-web/` directory, which is externally reachable via the appliance's web interface. Observed automated exploitation attempted access to deployed webshells using a `pwd=123` authentication/parameter convention, consistent with a common public webshell template rather than bespoke tooling. Because the write occurs in a service context with elevated privileges, this file-write primitive is chained to root-level command execution. Cisco assigned this the Security Impact Rating of Critical (above what the CVSS base score of 8.6 alone would suggest) specifically because of the root privilege-escalation potential.

Exploitation requires the WebDialer service to be enabled; it is disabled by default, which somewhat limits the exposed population to Unified CM/SME deployments that have explicitly turned on click-to-dial functionality — commonly enterprise and telecom environments with browser or CRM-integrated dialing. The Shadowserver Foundation's internet-wide scanning identified over 200 exposed Cisco Unified CM instances reachable from the public internet at the time of disclosure. Cisco published the fixed-release advisory cisco-sa-cucm-ssrf-cXPnHcW on 2026-06-03. Public proof-of-concept exploit code became available around 2026-06-05, and a third-party technical writeup (denizhalil.com) detailing the SSRF-to-file-write-to-root mechanics was published 2026-06-12. Threat-intel firm Defused first observed genuine in-the-wild exploitation attempts around 2026-06-21/22, describing a single source IP sending well-formed file:// file-write payloads against decoy (honeypot) Unified CM instances — consistent with mass internet scanning/reconnaissance using an "unvetted" public PoC rather than a bespoke or targeted operation. The observed payloads attempted to write an innocuous test file (e.g. /tmp/cve-2026-20230-test.txt) to fingerprint vulnerable, internet-exposed systems ahead of further exploitation; follow-on activity progressed to automated webshell drops via the Axis/WSDD chain described above. Reporting from LatestHackingNews and Rescana indicates the scanning/exploitation campaign routed its traffic through the Tor anonymizing network to mask attacker source infrastructure, consistent with opportunistic mass exploitation rather than a targeted, attributable intrusion. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on 2026-06-25 and, per Binding Operational Directive (BOD) 26-04, gave U.S. federal civilian agencies until 2026-06-28 to remediate — an unusually short three-day window reflecting the severity of unauthenticated root compromise on VoIP call-control infrastructure. Cisco itself did not initially confirm active exploitation publicly; outlets including BleepingComputer sought confirmation and IOCs directly from Cisco PSIRT. Cisco later (around 2026-07-01) acknowledged awareness of exploitation reported the prior month.

Unified CM and Unified CM SME sit at the center of enterprise voice/video call routing and session management, making them high-value targets: compromise can enable call interception, toll fraud, lateral movement into the broader UC estate, and disruption of emergency/PSAP-adjacent communications in some deployments. Because WebDialer-enabled instances are frequently reachable from internal corporate networks and, in some misconfigured deployments, from the internet for remote/softphone click-to-dial, the unauthenticated nature of the flaw is especially dangerous. Defenders should treat any Unified CM/SME appliance with WebDialer enabled as an urgent patch priority, audit `/platform-services/axis2-web/` and `/tmp/` for unexpected `.jsp` files or writes, review WebDialer and `cmplatform` access logs for requests to `installClusterStatusExecute` containing path-traversal sequences or `pwd=123`-style webshell probes, block known Tor exit-node egress where feasible, and disable WebDialer where the feature is not operationally required.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1592.002 Software
- T1588.005 Exploits
- T1190 Exploit Public-Facing Application
- T1505 Server Software Component
- T1203 Exploitation for Client Execution
- T1505.003 Web Shell
- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1211 Exploitation for Stealth
- T1090.003 Multi-hop Proxy
- T1222 File and Directory Permissions Modification
- T1016 System Network Configuration Discovery
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1105 Ingress Tool Transfer
- T1565.001 Stored Data Manipulation

## Sources

- [Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability (cisco-sa-cucm-ssrf-cXPnHcW)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW)
- [Cisco Unified CM vulnerability news coverage](https://cybersecuritynews.com/cisco-unified-cm-vulnerability-2/)
- [CVE-2026-20230: Cisco Unified CM SSRF — Horizon3.ai Attack Research](https://horizon3.ai/attack-research/vulnerabilities/cve-2026-20230/)
- [CVE-2026-20230: Cisco Unified Communications Manager SSRF to Remote Code Execution Vulnerability](https://threat-modeling.com/cve-2026-20230-cisco-unified-communications-manager-ssrf-rce/)
- [CISA sets urgent deadline to fix Cisco flaw exploited in attacks](https://www.bleepingcomputer.com/news/security/cisa-sets-urgent-deadline-to-fix-cisco-flaw-exploited-in-attacks/)
- [CISA Adds Two Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/06/25/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [Cisco Unified CM SME flaw CVE-2026-20230 now exploited in attacks](https://www.bleepingcomputer.com/news/security/cisco-unified-cm-sme-flaw-cve-2026-20230-now-exploited-in-attacks/)
- [CVE-2026-20230 Detail — NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-20230)
- [Cisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to Root](https://thehackernews.com/2026/06/cisco-unified-cm-flaw-exploited-after.html)
- [Hackers Exploiting Cisco Unified CM Vulnerability](https://www.securityweek.com/hackers-exploiting-cisco-unified-cm-vulnerability/)
- [Cisco finally confirms attackers exploiting Unified CM flaw](https://www.bleepingcomputer.com/news/security/cisco-finally-confirms-attackers-exploiting-unified-cm-flaw/)
- [CISA Known Exploited Vulnerabilities Catalog entry — CVE-2026-20230](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20230)
- [CVE-2026-20230: Cisco Unified CM SSRF & Root Exploit Analysis — denizhalil.com](https://denizhalil.com/2026/06/12/cve-2026-20230-cisco-unified-cm-ssrf/)
- [CVE-2026-20230: Cisco Unified CM WebDialer SSRF Can Lead to Root-Level Compromise — SOCRadar](https://socradar.io/blog/cve-2026-20230-cisco-unified-cm-webdialer-ssrf/)
- [Active Exploitation Alert: Cisco CUCM CVE-2026-20230 SSRF-RCE Flaw Weaponized Within 24 Hours of Disclosure — Rescana](https://www.rescana.com/post/active-exploitation-alert-cisco-cucm-cve-2026-20230-ssrf-rce-flaw-weaponized-within-24-hours-of-disclosure)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1243