Cisco rates Unified CM SSRF flaw critical over root takeover risk

Cisco is warning that a server-side request forgery (SSRF) vulnerability in Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition can be chained to full root compromise. The company has assigned the advisory a Security Impact Rating of Critical even though the CVSS base score is 8.6, because successful exploitation can hand an attacker the keys to the underlying system.

Tracked as CVE-2026-20230, the flaw stems from improper input validation and lets an unauthenticated, remote attacker send crafted requests to an affected device. Exploitation allows the attacker to write files to the underlying operating system, which can then be used to escalate privileges to root. The attack requires the WebDialer service to be enabled; it is disabled in default configurations, which limits exposure to deployments that have turned the feature on.

The vulnerability affects Unified CM and Unified CM SME releases 14.0 through 14SU5 and 15.0 through 15SU4a. Cisco has published free software updates to remediate the issue, and administrators who cannot patch immediately can mitigate by disabling the WebDialer service until fixes are applied.

The urgency is underscored by the bug’s inclusion in CISA’s Known Exploited Vulnerabilities catalog, indicating confirmed exploitation in the wild. Enterprise voice platforms are attractive targets because they sit deep inside corporate networks and often bridge trusted internal systems, so telephony administrators should verify whether WebDialer is exposed and prioritise patching their Unified CM clusters.

Sources: Cisco Security Advisory NVD: CVE-2026-20230

Drafted with AI assistance and reviewed by the IT Magazine news desk. Facts verified against the linked sources. Spotted an error? See our Corrections Policy.