Hackers Targeting Cisco Unified CM Zero-Day

Cisco has released patches for CVE-2026-20045, a critical vulnerability affecting several unified communications products including Cisco Unified Communications Manager and its SME, Unified CM IM & Presence Service, Unity Connection, and Webex Calling Dedicated Instance. According to Cisco, a remote, unauthenticated attacker can exploit the flaw to execute malicious commands on the device’s underlying OS, with a successful exploit potentially granting user-level access before elevating to root.

The zero-day, reported by unnamed external researchers, can be exploited via specially crafted HTTP requests to the target’s web-based management interface. Hunter’s results show roughly 1,300 internet-exposed Cisco Unified CM instances, with about half located in the United States, and CISA has added CVE-2026-20045 to its Known Exploited Vulnerabilities catalog, instructing federal agencies to address it by 11 February.

The KEV catalog currently includes around 80 Cisco vulnerabilities exploited in the wild over the past decade, with eight added to the must-patch list in the past year.