Vulnerability-Lookup

CVE-2026-20230 (GCVE-0-2026-20230)

Vulnerability from cvelistv5 – Published: 2026-06-03 16:09 – Updated: 2026-07-01 16:28

CISA Previdian

Title

Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability

Summary

A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root. Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root. Note: To exploit this vulnerability, the WebDialer service must be enabled. WebDialer is disabled by default.

Severity

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

SSVC

Exploitation: active Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-03 00:00 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

cisco mitre root Scorecard

References

3 references

URL	Tags
https://sec.cloudapps.cisco.com/security/center/c…
https://denizhalil.com/2026/06/12/cve-2026-20230-…	exploit
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource

Impacted products

1 product

Vendor	Product	Version
Cisco	Cisco Unified Communications Manager	Affected: 14 Affected: 14SU1 Affected: 14SU2 Affected: 14SU3 Affected: 15 Affected: 15SU1 Affected: 14SU4 Affected: 14SU4a Affected: 15SU1a Affected: 15SU2 Affected: 15.0.1.13010-1 Affected: 15.0.1.13011-1 Affected: 15.0.1.13012-1 Affected: 15.0.1.13013-1 Affected: 15.0.1.13014-1 Affected: 15.0.1.13015-1 Affected: 15.0.1.13016-1 Affected: 15.0.1.13017-1 Affected: 15SU3a Affected: 14SU5 Affected: 15SU4 Affected: 15SU4a

CISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 6286a1a3-dac7-4105-aa50-ed1973b7c037

Vulnerability ID: CVE-2026-20230

Status: Confirmed

Status Updated: 2026-06-25 02:00 CEST

Exploited: Yes

Timestamps

First Seen: 2026-06-25

Asserted: 2026-06-25

Scope

Notes: Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability | Affected: Cisco / Unified Communications Manager | Description: Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) Vulnerability that could allow an unauthenticated, remote attacker to write files to the underlying operating system that could be used later to elevate to root. | Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. | Due date: 2026-06-28 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-cucm-ssrf-cXPnHcW.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-20230

Evidence

Type: Vendor Report

Signal: Successful Exploitation

Confidence: 80%

Source: cisa-kev

Details

Cwes	CWE-918
Feed	CISA Known Exploited Vulnerabilities Catalog
Product	Unified Communications Manager
Due Date	2026-06-28
Date Added	2026-06-25
Vendorproject	Cisco
Vulnerabilityname	Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability
Knownransomwarecampaignuse	Unknown

References

CVE-2026-20230

Created: 2026-10-02 08:09 CEST | Updated: 2026-10-02 08:09 CEST

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 3d963dc0-2ed8-4b87-a4f6-3cb59e2d4f56

Vulnerability ID: CVE-2026-20230

Status: Confirmed

Status Updated: 2026-06-24 00:20 CEST

Exploited: Yes

Timestamps

First Seen: 2026-06-23

Asserted: 2026-06-23

Scope

Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: previdian

Details

Feed	Previdian (previdian.com)
Title	Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability
Cve Id	CVE-2026-20230
Vendor	Cisco
Ghsa Id	GHSA-FCV7-PCHJ-75C2
Product	Cisco Unified Communications Manager
Added Date	2026-06-23T22:20:36.536Z
Cvss Score	8.6
Epss Score	0.882
Previous Ids
Cvss Severity	HIGH
Virtual Patch	True
Cvss Estimated	False
Epss Percentile	0.99766
Used In Malware	unknown
Vulnerability Id	CVE-2026-20230
Ahead Of Cisa Kev	`{ "count": 2, "unit": "day" }`
Not Yet In Cisa Kev	False

References

Created: 2026-10-02 09:09 CEST | Updated: 2026-10-02 09:09 CEST

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-20230",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-03T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-26T03:55:19.730Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://denizhalil.com/2026/06/12/cve-2026-20230-cisco-unified-cm-ssrf/"
          },
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20230"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco Unified Communications Manager",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "14"
            },
            {
              "status": "affected",
              "version": "14SU1"
            },
            {
              "status": "affected",
              "version": "14SU2"
            },
            {
              "status": "affected",
              "version": "14SU3"
            },
            {
              "status": "affected",
              "version": "15"
            },
            {
              "status": "affected",
              "version": "15SU1"
            },
            {
              "status": "affected",
              "version": "14SU4"
            },
            {
              "status": "affected",
              "version": "14SU4a"
            },
            {
              "status": "affected",
              "version": "15SU1a"
            },
            {
              "status": "affected",
              "version": "15SU2"
            },
            {
              "status": "affected",
              "version": "15.0.1.13010-1"
            },
            {
              "status": "affected",
              "version": "15.0.1.13011-1"
            },
            {
              "status": "affected",
              "version": "15.0.1.13012-1"
            },
            {
              "status": "affected",
              "version": "15.0.1.13013-1"
            },
            {
              "status": "affected",
              "version": "15.0.1.13014-1"
            },
            {
              "status": "affected",
              "version": "15.0.1.13015-1"
            },
            {
              "status": "affected",
              "version": "15.0.1.13016-1"
            },
            {
              "status": "affected",
              "version": "15.0.1.13017-1"
            },
            {
              "status": "affected",
              "version": "15SU3a"
            },
            {
              "status": "affected",
              "version": "14SU5"
            },
            {
              "status": "affected",
              "version": "15SU4"
            },
            {
              "status": "affected",
              "version": "15SU4a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device.\r\n\r\nThis vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root.\r\nNote: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.\r\nNote: To exploit this vulnerability, the WebDialer service must be enabled. WebDialer is disabled by default."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is aware that proof-of-concept exploit code is available for the vulnerability that is described in this advisory.\r\n\r\nIn June 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability. Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-01T16:28:16.838Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-cucm-ssrf-cXPnHcW",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW"
        }
      ],
      "source": {
        "advisory": "cisco-sa-cucm-ssrf-cXPnHcW",
        "defects": [
          "CSCws67331"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2026-20230",
    "datePublished": "2026-06-03T16:09:45.961Z",
    "dateReserved": "2025-10-08T11:59:15.399Z",
    "dateUpdated": "2026-07-01T16:28:16.838Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-20230",
      "date": "2026-10-05",
      "epss": "0.882",
      "percentile": "0.99766"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unknown",
                "product": "Cisco Unified Communications Manager",
                "vendor": "Cisco",
                "versions": [
                  {
                    "status": "affected",
                    "version": "14"
                  },
                  {
                    "status": "affected",
                    "version": "14SU1"
                  },
                  {
                    "status": "affected",
                    "version": "14SU2"
                  },
                  {
                    "status": "affected",
                    "version": "14SU3"
                  },
                  {
                    "status": "affected",
                    "version": "15"
                  },
                  {
                    "status": "affected",
                    "version": "15SU1"
                  },
                  {
                    "status": "affected",
                    "version": "14SU4"
                  },
                  {
                    "status": "affected",
                    "version": "14SU4a"
                  },
                  {
                    "status": "affected",
                    "version": "15SU1a"
                  },
                  {
                    "status": "affected",
                    "version": "15SU2"
                  },
                  {
                    "status": "affected",
                    "version": "15.0.1.13010-1"
                  },
                  {
                    "status": "affected",
                    "version": "15.0.1.13011-1"
                  },
                  {
                    "status": "affected",
                    "version": "15.0.1.13012-1"
                  },
                  {
                    "status": "affected",
                    "version": "15.0.1.13013-1"
                  },
                  {
                    "status": "affected",
                    "version": "15.0.1.13014-1"
                  },
                  {
                    "status": "affected",
                    "version": "15.0.1.13015-1"
                  },
                  {
                    "status": "affected",
                    "version": "15.0.1.13016-1"
                  },
                  {
                    "status": "affected",
                    "version": "15.0.1.13017-1"
                  },
                  {
                    "status": "affected",
                    "version": "15SU3a"
                  },
                  {
                    "status": "affected",
                    "version": "14SU5"
                  },
                  {
                    "status": "affected",
                    "version": "15SU4"
                  },
                  {
                    "status": "affected",
                    "version": "15SU4a"
                  }
                ]
              }
            ],
            "source": "psirt@cisco.com"
          }
        ],
        "cisaActionDue": "2026-06-28",
        "cisaExploitAdd": "2026-06-25",
        "cisaRequiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset\u0027s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
        "cisaVulnerabilityName": "Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability",
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:-:*:*:*",
                    "matchCriteriaId": "9E708402-3D51-4165-8A97-2B3E68116553",
                    "versionEndExcluding": "14su6",
                    "versionStartIncluding": "14.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:session_management:*:*:*",
                    "matchCriteriaId": "321D5CC9-ECFC-42FD-AAB4-465E3BC399DA",
                    "versionEndExcluding": "14su6",
                    "versionStartIncluding": "14.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:-:*:*:*",
                    "matchCriteriaId": "EFBE275E-8043-4F8B-ABE8-48774CF11648",
                    "versionEndIncluding": "15su4a",
                    "versionStartIncluding": "15.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:session_management:*:*:*",
                    "matchCriteriaId": "06300542-9590-4FE0-8054-7BD15B2CB3BA",
                    "versionEndIncluding": "15su4a",
                    "versionStartIncluding": "15.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device.\r\n\r\nThis vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root.\r\nNote: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.\r\nNote: To exploit this vulnerability, the WebDialer service must be enabled. WebDialer is disabled by default."
          },
          {
            "lang": "es",
            "value": "Una vulnerabilidad en Cisco Unified Communications Manager (Unified CM) y Cisco Unified Communications Manager Session Management Edition (Unified CM SME) podr\u00eda permitir a un atacante remoto no autenticado realizar ataques de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) a trav\u00e9s de un dispositivo afectado.\nEsta vulnerabilidad se debe a una validaci\u00f3n de entrada incorrecta para peticiones HTTP espec\u00edficas. Un atacante podr\u00eda explotar esta vulnerabilidad enviando una petici\u00f3n HTTP manipulada a un dispositivo afectado. Un exploit exitoso podr\u00eda permitir al atacante escribir archivos en el sistema operativo subyacente que podr\u00edan usarse m\u00e1s tarde para elevar a root.\nNota: Cisco ha asignado a este aviso de seguridad una Calificaci\u00f3n de Impacto de Seguridad (SIR) de Cr\u00edtica en lugar de Alta, como indica la puntuaci\u00f3n. La raz\u00f3n es que la explotaci\u00f3n de esta vulnerabilidad podr\u00eda resultar en que un atacante eleve privilegios a root.\nNota: Para explotar esta vulnerabilidad, el servicio WebDialer debe estar habilitado. WebDialer est\u00e1 deshabilitado por defecto."
          }
        ],
        "id": "CVE-2026-20230",
        "lastModified": "2026-07-22T19:10:00.120",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.6,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 4.0,
              "source": "psirt@cisco.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-20230",
                "options": [
                  {
                    "exploitation": "active"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-03T00:00:00+00:00",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-06-03T18:16:20.160",
        "references": [
          {
            "source": "psirt@cisco.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "Exploit",
              "Third Party Advisory"
            ],
            "url": "https://denizhalil.com/2026/06/12/cve-2026-20230-cisco-unified-cm-ssrf/"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "US Government Resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20230"
          }
        ],
        "sourceIdentifier": "psirt@cisco.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-918"
              }
            ],
            "source": "psirt@cisco.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-20230",
                    "options": [
                      {
                        "Exploitation": "active"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-25T19:50:08.910362Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-03T17:36:57.584Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://denizhalil.com/2026/06/12/cve-2026-20230-cisco-unified-cm-ssrf/"
              },
              {
                "tags": [
                  "government-resource"
                ],
                "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20230"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unknown",
              "product": "Cisco Unified Communications Manager",
              "vendor": "Cisco",
              "versions": [
                {
                  "status": "affected",
                  "version": "14"
                },
                {
                  "status": "affected",
                  "version": "14SU1"
                },
                {
                  "status": "affected",
                  "version": "14SU2"
                },
                {
                  "status": "affected",
                  "version": "14SU3"
                },
                {
                  "status": "affected",
                  "version": "15"
                },
                {
                  "status": "affected",
                  "version": "15SU1"
                },
                {
                  "status": "affected",
                  "version": "14SU4"
                },
                {
                  "status": "affected",
                  "version": "14SU4a"
                },
                {
                  "status": "affected",
                  "version": "15SU1a"
                },
                {
                  "status": "affected",
                  "version": "15SU2"
                },
                {
                  "status": "affected",
                  "version": "15.0.1.13010-1"
                },
                {
                  "status": "affected",
                  "version": "15.0.1.13011-1"
                },
                {
                  "status": "affected",
                  "version": "15.0.1.13012-1"
                },
                {
                  "status": "affected",
                  "version": "15.0.1.13013-1"
                },
                {
                  "status": "affected",
                  "version": "15.0.1.13014-1"
                },
                {
                  "status": "affected",
                  "version": "15.0.1.13015-1"
                },
                {
                  "status": "affected",
                  "version": "15.0.1.13016-1"
                },
                {
                  "status": "affected",
                  "version": "15.0.1.13017-1"
                },
                {
                  "status": "affected",
                  "version": "15SU3a"
                },
                {
                  "status": "affected",
                  "version": "14SU5"
                },
                {
                  "status": "affected",
                  "version": "15SU4"
                },
                {
                  "status": "affected",
                  "version": "15SU4a"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device.\r\n\r\nThis vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root.\r\nNote: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.\r\nNote: To exploit this vulnerability, the WebDialer service must be enabled. WebDialer is disabled by default."
            }
          ],
          "exploits": [
            {
              "lang": "en",
              "value": "The Cisco PSIRT is aware that proof-of-concept exploit code is available for the vulnerability that is described in this advisory.\r\n\r\nIn June 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability. Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.6,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
                "version": "3.1"
              },
              "format": "cvssV3_1"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-918",
                  "description": "Server-Side Request Forgery (SSRF)",
                  "lang": "en",
                  "type": "cwe"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-01T16:28:16.838Z",
            "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
            "shortName": "cisco"
          },
          "references": [
            {
              "name": "cisco-sa-cucm-ssrf-cXPnHcW",
              "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW"
            }
          ],
          "source": {
            "advisory": "cisco-sa-cucm-ssrf-cXPnHcW",
            "defects": [
              "CSCws67331"
            ],
            "discovery": "EXTERNAL"
          },
          "title": "Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "assignerShortName": "cisco",
        "cveId": "CVE-2026-20230",
        "datePublished": "2026-06-03T16:09:45.961Z",
        "dateReserved": "2025-10-08T11:59:15.399Z",
        "dateUpdated": "2026-07-01T16:28:16.838Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

BDU:2026-07815 (CVE-2026-20230)

Vulnerability from fstec – Published: 2026-06-05 – Updated: 2026-06-29 – View on bdu.fstec.ru Exploit publicly available Yes Fixed

CISA Previdian

Title

Summary

Уязвимость службы WebDialer систем обработки вызовов Cisco Unified Communications Manager (Unified CM) и Cisco Unified Communications Manager Session Management Edition (Unified CM SME) связана с недостаточной проверкой запросов на стороне сервера. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, осуществить SSRF-атаку

Severity

7.8 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:N/I:C/A:N

8.6 (High) CVSS 3.1


                      
                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Spoofing

Incidents

Yes

Remediation

Software update

CWE

CWE-918 - Серверная фальсификация запросов

Aliases

CVE-2026-20230

References

5 references

URL
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/c…
https://undercodenews.com/cve-2026-20230-critical-cisco-unified-cm-ssrf-flaw-ex…
https://www.acn.gov.it/portale/w/cisco-cucm-disponibile-poc-per-lo-sfruttamento…
https://www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv
https://denizhalil.com/2026/06/12/cve-2026-20230-cisco-unified-cm-ssrf/

Impacted products

2 products from 2 vendors

Vendors

Cisco Systems, Inc.

Products

Cisco Unified Communications Manager, Cisco Unified Communications Manager SME

Versions

от 14 до 14SU6 (Cisco Unified Communications Manager), от 15 до 15SU5 (Cisco Unified Communications Manager), от 14 до 14SU6 (Cisco Unified Communications Manager SME), от 15 до 15SU5 (Cisco Unified Communications Manager SME)

Product types

Network software, Network appliance software

Mitigations

Использование рекомендаций производителя: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:N/I:C/A:N",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Cisco Systems, Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u043e\u0442 14 \u0434\u043e 14SU6 (Cisco Unified Communications Manager), \u043e\u0442 15 \u0434\u043e 15SU5 (Cisco Unified Communications Manager), \u043e\u0442 14 \u0434\u043e 14SU6 (Cisco Unified Communications Manager SME), \u043e\u0442 15 \u0434\u043e 15SU5 (Cisco Unified Communications Manager SME)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "03.06.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "29.06.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "05.06.2026",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2026-07815",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2026-20230",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Cisco Unified Communications Manager, Cisco Unified Communications Manager SME",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u043b\u0443\u0436\u0431\u044b WebDialer \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0432\u044b\u0437\u043e\u0432\u043e\u0432 Cisco Unified Communications Manager (Unified CM) \u0438 Cisco Unified Communications Manager Session Management Edition (Unified CM SME), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c SSRF-\u0430\u0442\u0430\u043a\u0443",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0421\u0435\u0440\u0432\u0435\u0440\u043d\u0430\u044f \u0444\u0430\u043b\u044c\u0441\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 (CWE-918)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u043b\u0443\u0436\u0431\u044b WebDialer \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0432\u044b\u0437\u043e\u0432\u043e\u0432 Cisco Unified Communications Manager (Unified CM) \u0438 Cisco Unified Communications Manager Session Management Edition (Unified CM SME) \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c SSRF-\u0430\u0442\u0430\u043a\u0443",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041f\u043e\u0434\u043c\u0435\u043d\u0430 \u043f\u0440\u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW\nhttps://undercodenews.com/cve-2026-20230-critical-cisco-unified-cm-ssrf-flaw-exposes-enterprises-to-root-level-takeover-via-public-exploit-code-video/\nhttps://www.acn.gov.it/portale/w/cisco-cucm-disponibile-poc-per-lo-sfruttamento-di-vulnerabilita\nhttps://www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv\nhttps://denizhalil.com/2026/06/12/cve-2026-20230-cisco-unified-cm-ssrf/",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e, \u041f\u041e \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-918",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,8)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 8,6)"
}

CERTFR-2026-AVI-0689

Vulnerability from certfr_avis - Published: 2026-06-04 - Updated: 2026-06-04

Une vulnérabilité a été découverte dans les produits Cisco. Elle permet à un attaquant de provoquer une falsification de requêtes côté serveur (SSRF).

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Cisco	Unified Communications Manager	Unified Communications Manager versions 15 antérieures à 15SU5 (disponible en Septembre 2026) or COP1
Cisco	Unified Communications Manager	Unified Communications Manager versions 14 antérieures à 14SU6
Cisco	Unified Communications Manager Session Management Edition	Unified Communications Manager Session Management Edition versions 15 antérieures à 15SU5 (disponible en Septembre 2026) ou COP1
Cisco	Unified Communications Manager Session Management Edition	Unified Communications Manager Session Management Edition versions 14 antérieures à 14SU6

References

Title

Publication Time

CISCO-SA-CUCM-SSRF-CXPNHCW

Vulnerability from csaf_cisco - Published: 2026-06-03 16:00 - Updated: 2026-07-01 15:10

Summary

Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability

Scope

1 vulnerability in this advisory, including CVE-2026-20230.

CVE-2026-20230

8.6 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Known affected: 23 products

https://software.cisco.com

Open the full advisory

EUVD-2026-331905

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-02 07:50

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-02T07:50:30.584579+00:00",
  "id": "EUVD-2026-331905"
}

FKIE_CVE-2026-20230

Vulnerability from fkie_nvd - Published: 2026-06-03 18:16 - Updated: 2026-07-22 19:10

CISA Previdian

Severity

8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Summary

References

URL	Tags
psirt@cisco.com	https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW	Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://denizhalil.com/2026/06/12/cve-2026-20230-cisco-unified-cm-ssrf/	Exploit, Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20230	US Government Resource

Impacted products

Vendor	Product	Version
cisco	unified_communications_manager	*
cisco	unified_communications_manager	*
cisco	unified_communications_manager	*
cisco	unified_communications_manager	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unknown",
          "product": "Cisco Unified Communications Manager",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "14"
            },
            {
              "status": "affected",
              "version": "14SU1"
            },
            {
              "status": "affected",
              "version": "14SU2"
            },
            {
              "status": "affected",
              "version": "14SU3"
            },
            {
              "status": "affected",
              "version": "15"
            },
            {
              "status": "affected",
              "version": "15SU1"
            },
            {
              "status": "affected",
              "version": "14SU4"
            },
            {
              "status": "affected",
              "version": "14SU4a"
            },
            {
              "status": "affected",
              "version": "15SU1a"
            },
            {
              "status": "affected",
              "version": "15SU2"
            },
            {
              "status": "affected",
              "version": "15.0.1.13010-1"
            },
            {
              "status": "affected",
              "version": "15.0.1.13011-1"
            },
            {
              "status": "affected",
              "version": "15.0.1.13012-1"
            },
            {
              "status": "affected",
              "version": "15.0.1.13013-1"
            },
            {
              "status": "affected",
              "version": "15.0.1.13014-1"
            },
            {
              "status": "affected",
              "version": "15.0.1.13015-1"
            },
            {
              "status": "affected",
              "version": "15.0.1.13016-1"
            },
            {
              "status": "affected",
              "version": "15.0.1.13017-1"
            },
            {
              "status": "affected",
              "version": "15SU3a"
            },
            {
              "status": "affected",
              "version": "14SU5"
            },
            {
              "status": "affected",
              "version": "15SU4"
            },
            {
              "status": "affected",
              "version": "15SU4a"
            }
          ]
        }
      ],
      "source": "psirt@cisco.com"
    }
  ],
  "cisaActionDue": "2026-06-28",
  "cisaExploitAdd": "2026-06-25",
  "cisaRequiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset\u0027s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
  "cisaVulnerabilityName": "Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:-:*:*:*",
              "matchCriteriaId": "9E708402-3D51-4165-8A97-2B3E68116553",
              "versionEndExcluding": "14su6",
              "versionStartIncluding": "14.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:session_management:*:*:*",
              "matchCriteriaId": "321D5CC9-ECFC-42FD-AAB4-465E3BC399DA",
              "versionEndExcluding": "14su6",
              "versionStartIncluding": "14.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:-:*:*:*",
              "matchCriteriaId": "EFBE275E-8043-4F8B-ABE8-48774CF11648",
              "versionEndIncluding": "15su4a",
              "versionStartIncluding": "15.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:session_management:*:*:*",
              "matchCriteriaId": "06300542-9590-4FE0-8054-7BD15B2CB3BA",
              "versionEndIncluding": "15su4a",
              "versionStartIncluding": "15.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device.\r\n\r\nThis vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root.\r\nNote: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.\r\nNote: To exploit this vulnerability, the WebDialer service must be enabled. WebDialer is disabled by default."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en Cisco Unified Communications Manager (Unified CM) y Cisco Unified Communications Manager Session Management Edition (Unified CM SME) podr\u00eda permitir a un atacante remoto no autenticado realizar ataques de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) a trav\u00e9s de un dispositivo afectado.\nEsta vulnerabilidad se debe a una validaci\u00f3n de entrada incorrecta para peticiones HTTP espec\u00edficas. Un atacante podr\u00eda explotar esta vulnerabilidad enviando una petici\u00f3n HTTP manipulada a un dispositivo afectado. Un exploit exitoso podr\u00eda permitir al atacante escribir archivos en el sistema operativo subyacente que podr\u00edan usarse m\u00e1s tarde para elevar a root.\nNota: Cisco ha asignado a este aviso de seguridad una Calificaci\u00f3n de Impacto de Seguridad (SIR) de Cr\u00edtica en lugar de Alta, como indica la puntuaci\u00f3n. La raz\u00f3n es que la explotaci\u00f3n de esta vulnerabilidad podr\u00eda resultar en que un atacante eleve privilegios a root.\nNota: Para explotar esta vulnerabilidad, el servicio WebDialer debe estar habilitado. WebDialer est\u00e1 deshabilitado por defecto."
    }
  ],
  "id": "CVE-2026-20230",
  "lastModified": "2026-07-22T19:10:00.120",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.0,
        "source": "psirt@cisco.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-20230",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-03T00:00:00+00:00",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-03T18:16:20.160",
  "references": [
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://denizhalil.com/2026/06/12/cve-2026-20230-cisco-unified-cm-ssrf/"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20230"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "psirt@cisco.com",
      "type": "Secondary"
    }
  ]
}

GHSA-FCV7-PCHJ-75C2

Vulnerability from github – Published: 2026-06-03 18:33 – Updated: 2026-06-25 21:31

Details

This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root.

Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.

Note: To exploit this vulnerability, the WebDialer service must be enabled. WebDialer is disabled by default.

Severity

8.6 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-20230"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-03T18:16:20Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device.\n\n This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root.\n\n Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.\n\n Note: To exploit this vulnerability, the WebDialer service must be enabled. WebDialer is disabled by default.",
  "id": "GHSA-fcv7-pchj-75c2",
  "modified": "2026-06-25T21:31:22Z",
  "published": "2026-06-03T18:33:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20230"
    },
    {
      "type": "WEB",
      "url": "https://denizhalil.com/2026/06/12/cve-2026-20230-cisco-unified-cm-ssrf"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20230"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

NCSC-2026-0174

Vulnerability from csaf_ncscnl - Published: 2026-06-04 11:34 - Updated: 2026-06-04 11:34

Summary

Kwetsbaarheid verholpen in Cisco Unified Communications Manager

Scope

1 vulnerability in this advisory, including CVE-2026-20230.

CVE-2026-20230

8.6 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Known affected: 1 product

Open the full advisory

WID-SEC-W-2026-1801

Vulnerability from csaf_certbund - Published: 2026-06-04 22:00 - Updated: 2026-06-23 22:00

Summary

Cisco Unified Communications Manager (CUCM): Schwachstelle ermöglicht Manipulation von Dateien

Severity

Hoch

Scope

1 vulnerability in this advisory, including CVE-2026-20230.

CVE-2026-20230

Known affected: 2 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-20230 (GCVE-0-2026-20230)

CISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Vendor Report Successful Exploitation Confidence: 80% Source: cisa-kev

Details

References

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Public Report Successful Exploitation Confidence: 70% Source: previdian

Details

References

BDU:2026-07815 (CVE-2026-20230)

CERTFR-2026-AVI-0689

Solutions

CISCO-SA-CUCM-SSRF-CXPNHCW

EUVD-2026-331905

FKIE_CVE-2026-20230

GHSA-FCV7-PCHJ-75C2

NCSC-2026-0174

WID-SEC-W-2026-1801

Tags

Sightings

Nomenclature

Related by attack behaviour