CVE-2026-20230

A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could…

High Known exploited

Severity: 8.6 / 10; High · CVSS 3.1
Exploit chance (EPSS): 88.53%; Chance of exploitation in the next 30 days. Higher than 99.77% of scored vulnerabilities.
Known exploited: Yes; In CISA's catalog since Jun 25, 2026
Weakness: CWE-918 Server-Side Request Forgery (SSRF)
Fix: None yet; No fixed version published

Exploited in the wild. Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability (Cisco Unified Communications Manager). Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Due for U.S. federal agencies by Jun 28, 2026.

Description

A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device.

This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root. Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root. Note: To exploit this vulnerability, the WebDialer service must be enabled. WebDialer is disabled by default.

How to fix

No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.

Severity breakdown

CVSS 3.1 8.6

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Changed
Confidentiality: None
Integrity: High
Availability: None

Weakness

CWE-918: Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References

Advisories

Timeline

Jun 3, 2026 Published
Jun 25, 2026 Added to CISA's Known Exploited Vulnerabilities catalog
Jun 28, 2026 Remediation due for U.S. federal agencies
Oct 7, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
EEF-CVE-2026-115700 SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney	Not rated yet	Same weakness, CWE-918
GHSA-2wqp-q3c6-ccj5 MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints	Medium	Same weakness, CWE-918
GHSA-2phh-27fw-q4gc PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading	Medium	Same weakness, CWE-918
GHSA-p3pr-8f3m-4qp8 pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host	Medium	Same weakness, CWE-918
GHSA-j8f7-x8jm-wmm4 Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)	Medium	Same weakness, CWE-918
GHSA-r7f2-6fj8-6fg2 Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses	Medium	Same weakness, CWE-918
GHSA-322m-ff4g-9vx9 Ghost: Server-Side Request Forgery in Bookmark Fetching	Medium	Same weakness, CWE-918
GHSA-cjq9-62q9-8jv4 Next.js has Server-Side Request Forgery in Image Optimization	Medium	Same weakness, CWE-918

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor