DaystoPatch

CiscoExploited incident

Cisco Unified Communications Products Remote Code Execution Vulnerability

CVE-2026-20045High, CVSS 8.2In CISA's Known Exploited Vulnerabilities catalog since 21 Jan 2026

  • Exploited before a fix
FixedFixed for every supported version under an hour after the first public report.

Response

Silence
0h
First public report to first vendor statement
Exposure
<1h
First public report to first fix
Follow-through
<1h
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Cisco advisory cisco-sa-voice-rce-mORhqY4bClaimedQuote verified

    Initial public release.

    Vendor advisory was the first public report.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d2504fe98ee0bd0c…
    Used in metrics
    Yes
    Dispute this timestamp
    6 more sources for this moment
    CISA KEV (CVE-2026-20045)ClaimedQuote verified21 Jan 2026

    Cisco Unified Communications Products Code Injection Vulnerability

    Added to CISA's KEV catalog on 2026-01-21.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Cisco advisory cisco-sa-voice-rce-mORhqY4bClaimedQuote verified21 Jan 2026, 16:00 UTC

    Cisco Unified Communications Products Remote Code Execution Vulnerability

    The vendor's own disclosure.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:5bf3fa1e2e8cfd17…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Cisco PSIRT advisory cisco-sa-voice-rce-mORhqY4b, v1.0 (Wayback snapshot 2026-01-21)CuratedQuote verified21 Jan 2026, 16:00 UTC

    The Cisco PSIRT is aware of attempted exploitation of this vulnerability in the wild.

    Exploitation disclosed in v1.0 ('First Published: 2026 January 21 16:00 GMT'; CSAF 1.0.0 at 2026-01-21T15:54:41+00:00). No earlier public report found.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:94408f4f39b37673…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-20045ClaimedQuote verified21 Jan 2026, 16:26 UTC

    A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM &amp;

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:96cc1bac1e20423b…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet21 Jan 2026, 17:08 UTC

    CVE-2026-20045 - Cisco Unified Communications Products Remote Code Execution Vulnerability

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet22 Jan 2026, 00:19 UTC

    Cisco załatało krytyczną lukę RCE – pilna aktualizacja dla UC już dziś Masz w firmie Unified Communications od Cisco? Odłóż kawę. Czytaj dalej: https:// pressmind.org/cisco-zalatalo-k

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    Cisco advisory cisco-sa-voice-rce-mORhqY4bClaimedQuote verified

    Initial public release.

    From the advisory's revision history.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d2504fe98ee0bd0c…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Cisco PSIRT advisory cisco-sa-voice-rce-mORhqY4bCuratedQuote not checked yet21 Jan 2026, 16:00 UTC

    First Published: 2026 January 21 16:00 GMT

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    +<1h

    Cisco PSIRT advisory cisco-sa-voice-rce-mORhqY4b, v1.0 (Wayback snapshot 2026-01-21)CuratedQuote verified

    Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:94408f4f39b37673…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Cisco advisory cisco-sa-voice-rce-mORhqY4bClaimedQuote verified13 Feb 2026, 15:21 UTC

    Updated COP versions in Fixed Releases table.

    CaveatRevision adds fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d2504fe98ee0bd0c…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    +<1h

    Cisco PSIRT advisory cisco-sa-voice-rce-mORhqY4b, v1.0 (Wayback snapshot 2026-01-21)CuratedQuote verified

    Patches are version-specific. Consult the README attached to the patch for details.

    v1.0 already offered version-specific COP patch files for releases 14 and 15 of both Unified CM and Unity Connection (14SU5 for release 14; 15SU4 listed as 'Mar 2026'); release 12.5 must migrate. Revision 1.1 (CSAF 2026-02-13T15:21:01+00:00) 'Updated COP versions in Fixed Releases table.' (new patch file names).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:94408f4f39b37673…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Cisco Unified Communications Manager (Unified CM)
  • Cisco Unified CM Session Management Edition
  • Cisco Unified CM IM & Presence Service
  • Cisco Unity Connection
  • Cisco Webex Calling Dedicated Instance
How we built this timeline

Zero-day at disclosure: Cisco said it was aware of attempted exploitation and released patches in the same advisory, so world = vendor = First fix. Severity follows the CVSS base score 8.2 (high);

Cisco rates the advisory SIR Critical because exploitation can lead to root. The February 2026 COP-version update may indicate the first patch files were replaced;

Cisco does not say why.

Related

Cisco report card