DaystoPatch

CiscoExploited incident

Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability

CVE-2026-20230High, CVSS 8.6In CISA's Known Exploited Vulnerabilities catalog since 25 Jun 2026

  • Exploited after a fix existed
FixedFixed for every supported version on the day it became public.

Response

Silence
0h
First public report to first vendor statement
Exposure
0h
First public report to first fix
Follow-through
0h
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Cisco PSIRT advisory cisco-sa-cucm-ssrf-cXPnHcW, v1.0 (Wayback snapshot 2026-06-04)CuratedQuote verified

    The Cisco PSIRT is aware that proof-of-concept exploit code is available for the vulnerability described in this advisory.

    Coordinated disclosure: the advisory (First Published 2026 June 3 16:00 GMT) was the first public signal and shipped with fixes; v1.0 also said Cisco was not aware of malicious use.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:bfd35b48396ee285…
    Used in metrics
    Yes
    Dispute this timestamp
    6 more sources for this moment
    CVE.org record CVE-2026-20230ClaimedQuote verified3 Jun 2026, 16:09 UTC

    A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:499eb2072bcb6d3a…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet3 Jun 2026, 19:00 UTC

    🟠 CVE-2026-20230 - High (8.6)

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet4 Jun 2026, 11:36 UTC

    Cisco Patches Critical Unified CM Flaw Exploitable for Root Access Cisco has patched a critical flaw in its Unified Communications Manager (Unified CM) that allowed hackers to remotely gain root

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    BleepingComputer (Lawrence Abrams, June 23, 2026)CuratedQuote verified23 Jun 2026

    Today, threat intelligence firm Defused warned that the flaw is now being actively exploited in attacks.

    First public report of in-the-wild exploitation, after fixes existed. Article byline 'June 23, 2026 05:48 PM' (zone not stated), so day precision.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:6c5c6490555593df…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Hacker NewsClaimedQuote not checked yet24 Jun 2026, 06:57 UTC

    Same-Day Shells: A Full-Chain RCE Sweep Against Cisco CUCM (CVE-2026-20230)

    Earliest third-party post we hold.

    Source
    Hacker News hn
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2026-20230)ClaimedQuote verified25 Jun 2026

    Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability

    Added to CISA's KEV catalog on 2026-06-25.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    Cisco PSIRT advisory cisco-sa-cucm-ssrf-cXPnHcWCuratedQuote verified

    First Published: 2026 June 3 16:00 GMT

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d172889254946225…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    at disclosure

    Cisco PSIRT advisory cisco-sa-cucm-ssrf-cXPnHcW, v1.0 (Wayback snapshot 2026-06-04)CuratedQuote verified

    However, as a mitigation, administrators may disable the WebDialer service until a patch can be applied.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:bfd35b48396ee285…
    Used in metrics
    Yes
    Dispute this timestamp

  4. First fix

    at disclosure

    Cisco PSIRT advisory cisco-sa-cucm-ssrf-cXPnHcW, v1.0 (Wayback snapshot 2026-06-04)CuratedQuote verified

    Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

    v1.0 fixed-release table: release 14 -> 14SU6; release 15 -> '15SU5 (Sep 2026) or COP' (version-specific patch).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:bfd35b48396ee285…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    at disclosure

    Cisco PSIRT advisory cisco-sa-cucm-ssrf-cXPnHcW, v1.0 (Wayback snapshot 2026-06-04)CuratedQuote verified

    Patches are version-specific. Consult the README attached to the patch for details.

    Both affected trains had a fix at v1.0: 14SU6 for release 14 and a COP patch for release 15 (the full 15SU5 release was listed as due Sep 2026). We did not verify the 15SU5 release date.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:bfd35b48396ee285…
    Used in metrics
    Yes
    Dispute this timestamp

This advisory changed after publication

  1. cisco-sa-cucm-ssrf-cXPnHcW

    Recorded in the revision history

    Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability

    Advisory now says the bug is exploited (earlier version: vendor not aware).

    • Exploitation status
    Exploitation status
    Beforevendor not aware of exploitation
    Aftervendor aware of exploitation
    Earlier version captured 4 Jun 2026, 06:36 UTC: archived copyLater version captured 19 Jul 2026, 02:31 UTC: archived copyRecovered from archived copiesSnapshots b7ec0ee86f… and d172889254…Incident page

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Cisco Unified Communications Manager (Unified CM)
  • Cisco Unified Communications Manager Session Management Edition (Unified CM SME)
How we built this timeline

Coordinated disclosure, exploited later: fixes shipped 3 Jun 2026; Defused reported in-the-wild exploitation (honeypots, single source IP, test-file payload) per BleepingComputer on 23 Jun 2026;

KEV listing 25 Jun 2026; Cisco's revision 1.1 (2026-JUL-01, Last Updated 2026 July 1 15:10 GMT) added 'In June 2026, the Cisco PSIRT became aware of active exploitation'.

Requires the WebDialer service, which is disabled by default. Severity follows the CVSS base score 8.6 (high);

Cisco rates the advisory SIR Critical because exploitation can lead to root. Reported through SSD Secure Disclosure.

Related

Cisco report card