CyberSIXT Search
Original
Image: Security Affairs

Security AffairsPierluigi Paganini

Cisco Fixes CVE-2026-20230 SSRF Flaw in Unified CM, Root Risk.

Part of the CVE-2026-20230 story · 16 articles · 8 outlets · since 4 Jun

Cisco has patched a critical vulnerability in its Unified CM system, tracked as CVE-2026-20230, which allows unauthenticated attackers to execute server-side request forgery (SSRF) attacks. The flaw arises from improper validation of HTTP requests and potential exploitation could lead to root privilege escalation. Cisco rated the vulnerability as critical due to its serious implications, especially when the WebDialer service is enabled.

Although public exploit code is available, Cisco's PSIRT has not noted any active attacks exploiting this issue. Users are advised to disable the WebDialer service until patches are applied. The first fixed releases for affected systems are noted as 14SU6 for Unified CM 14 and 15SU5 for Unified CM 15.

AI summary of the original article from Security Affairs, written automatically by a language model. Quotes, figures and names come from that article; check it before relying on a detail. Read the original · How summaries are made

Story timeline CVE-2026-20230

Full timeline
Show as table
CVE-2026-20230 coverage
Published (UTC)OutletHeadline
Thu 4 Jun · 03:51 UTCSecurityOnlineCisco Unified CM SSRF flaw exposes systems to remote takeover
Thu 4 Jun · 08:51 UTCSecurityWeekCisco patches CVE-2026-20230 UC Manager flaw enabling root access
Thu 4 Jun · 13:50 UTCSecurity AffairsCisco Fixes CVE-2026-20230 SSRF Flaw in Unified CM, Root Risk. (this article)
Thu 4 Jun · 17:11 UTCThe Hacker NewsCisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public
Fri 5 Jun · 13:01 UTCSOCRadarCisco patches SSRF flaw in Unified CM enabling root access
Wed 24 Jun · 05:50 UTCSecurityWeekCisco Unified CM flaw lets hackers gain root access via SSRF
Wed 24 Jun · 14:10 UTCSecurity AffairsCisco CUCM CVE-2026-20230 SSRF flaw lets attackers gain root
Thu 25 Jun · 22:22 UTCCISACisco Manager SSRF Flaw Exploited, CISA Adds CVE‑2026‑20230 to KEV
Thu 25 Jun · 22:40 UTCDark ReadingCisco CUCM flaw allows hackers to gain root access in 24 hours
Fri 26 Jun · 03:31 UTCSecurityOnlineCisco and PTC flaws under active attack, CISA adds to KEV list
Fri 26 Jun · 05:40 UTCSecurityOnlinePTC Windchill flaw spotted; Claude Fable 5 hints at AWS return
Fri 26 Jun · 06:19 UTCCISACISA Adds Cisco UC Manager SSRF Flaw to KEV Catalog
Fri 26 Jun · 11:31 UTCSecurity AffairsCISA adds critical PTC Windchill, Cisco UC flaws to KEV list
Fri 26 Jun · 14:21 UTCSecurityOnlineCisco SD-WAN Zero-Day Exploited in Attacks
Mon 29 Jun · 03:01 UTCSecurityOnlineCisco Unified CM RCE Flaw Exploited in the Wild as PoC Code Goes Public
Thu 2 Jul · 11:12 UTCSecurityWeekCisco Warns of Exploit in Manager SSRF Flaw CVE-2026-20230

Sources

Original articlesecurityaffairs.comPrimary sourcesec.cloudapps.cisco.com

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.
↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device