Skip to content
OriginalSign in

CISA

CISA Adds Cisco UC Manager SSRF Flaw to KEV Catalog

Part of the CVE-2026-20230 story · since 4 Jun

Quiet for 19 weekslast report 2 Jul16 articles7 outlets
4 Jun · SecurityOnline first23 Aug19 Sep16 OctNowThis article12th of 16
  • Thu 4 Jun, 03:51 UTC. SecurityOnline, first report. Cisco Unified CM SSRF flaw exposes systems to remote takeover. Cites a CVE in CISA KEV.
  • Thu 4 Jun, 08:51 UTC. SecurityWeek, its first report on the story. Cisco patches CVE-2026-20230 UC Manager flaw enabling root access. Cites a CVE in CISA KEV.
  • Thu 4 Jun, 13:50 UTC. Security Affairs, its first report on the story. Cisco Fixes CVE-2026-20230 SSRF Flaw in Unified CM, Root Risk.. Cites a CVE in CISA KEV.
  • Thu 4 Jun, 17:11 UTC. The Hacker News, its first report on the story. Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public. Cites a CVE in CISA KEV.
  • Fri 5 Jun, 13:01 UTC. SOCRadar, its first report on the story. Cisco patches SSRF flaw in Unified CM enabling root access. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 05:50 UTC. SecurityWeek. Cisco Unified CM flaw lets hackers gain root access via SSRF. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 14:10 UTC. Security Affairs. Cisco CUCM CVE-2026-20230 SSRF flaw lets attackers gain root. Cites a CVE in CISA KEV.
  • Thu 25 Jun, 22:22 UTC. CISA, its first report on the story. Cisco Manager SSRF Flaw Exploited, CISA Adds CVE‑2026‑20230 to KEV. Cites a CVE in CISA KEV.
  • Thu 25 Jun, 22:40 UTC. Dark Reading, its first report on the story. Cisco CUCM flaw allows hackers to gain root access in 24 hours. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 03:31 UTC. SecurityOnline. Cisco and PTC flaws under active attack, CISA adds to KEV list. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 05:40 UTC. SecurityOnline. PTC Windchill flaw spotted; Claude Fable 5 hints at AWS return. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 06:19 UTC. CISA. CISA Adds Cisco UC Manager SSRF Flaw to KEV Catalog. Cites a CVE in CISA KEV. This article, 12th of 16.
  • Fri 26 Jun, 11:31 UTC. Security Affairs. CISA adds critical PTC Windchill, Cisco UC flaws to KEV list. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 14:21 UTC. SecurityOnline. Cisco SD-WAN Zero-Day Exploited in Attacks. Cites a CVE in CISA KEV.
  • Mon 29 Jun, 03:01 UTC. SecurityOnline. Cisco Unified CM RCE Flaw Exploited in the Wild as PoC Code Goes Public. Cites a CVE in CISA KEV.
  • Thu 2 Jul, 11:12 UTC. SecurityWeek. Cisco Warns of Exploit in Manager SSRF Flaw CVE-2026-20230. Cites a CVE in CISA KEV.

The Known Exploited Vulnerabilities (KEV) Catalog, maintained by CISA, serves as an authoritative resource for identifying vulnerabilities actively exploited in the wild, aimed at assisting organizations in managing vulnerabilities and threat activities. The catalog can be integrated into vulnerability management frameworks, helping prioritize risk mitigation efforts.

The catalog currently lists CVE-2026-20230, which identifies a server-side request forgery (SSRF) vulnerability in Cisco Unified Communications Manager that may allow unauthenticated remote attackers to write files to the operating system. Users are encouraged to take practical mitigations as per vendor guidelines and follow CISA's BOD 26-04 recommendations for security updates based on risk. The catalog can be accessed in various formats, including CSV and JSON.

How the story developed

All 16 articles
Quiet for 19 weekslast report 2 Jul16 articles7 outlets

16 articles from 7 outlets since 4 Jun. Quiet since 2 Jul. This was the 12th report, 22 days after the first.

Now4 Jun81013161922252824First reportSecurityOnline · 4 Jun, 03:51This article12th of 16 · day 22
  • Thu 4 Jun, 03:51 UTC. SecurityOnline, first report. Cisco Unified CM SSRF flaw exposes systems to remote takeover. Cites a CVE in CISA KEV.
  • Thu 4 Jun, 08:51 UTC. SecurityWeek, its first report on the story. Cisco patches CVE-2026-20230 UC Manager flaw enabling root access. Cites a CVE in CISA KEV.
  • Thu 4 Jun, 13:50 UTC. Security Affairs, its first report on the story. Cisco Fixes CVE-2026-20230 SSRF Flaw in Unified CM, Root Risk.. Cites a CVE in CISA KEV.
  • Thu 4 Jun, 17:11 UTC. The Hacker News, its first report on the story. Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public. Cites a CVE in CISA KEV.
  • Fri 5 Jun, 13:01 UTC. SOCRadar, its first report on the story. Cisco patches SSRF flaw in Unified CM enabling root access. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 05:50 UTC. SecurityWeek. Cisco Unified CM flaw lets hackers gain root access via SSRF. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 14:10 UTC. Security Affairs. Cisco CUCM CVE-2026-20230 SSRF flaw lets attackers gain root. Cites a CVE in CISA KEV.
  • Thu 25 Jun, 22:22 UTC. CISA, its first report on the story. Cisco Manager SSRF Flaw Exploited, CISA Adds CVE‑2026‑20230 to KEV. Cites a CVE in CISA KEV.
  • Thu 25 Jun, 22:40 UTC. Dark Reading, its first report on the story. Cisco CUCM flaw allows hackers to gain root access in 24 hours. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 03:31 UTC. SecurityOnline. Cisco and PTC flaws under active attack, CISA adds to KEV list. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 05:40 UTC. SecurityOnline. PTC Windchill flaw spotted; Claude Fable 5 hints at AWS return. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 06:19 UTC. CISA. CISA Adds Cisco UC Manager SSRF Flaw to KEV Catalog. Cites a CVE in CISA KEV. This article, 12th of 16.
  • Fri 26 Jun, 11:31 UTC. Security Affairs. CISA adds critical PTC Windchill, Cisco UC flaws to KEV list. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 14:21 UTC. SecurityOnline. Cisco SD-WAN Zero-Day Exploited in Attacks. Cites a CVE in CISA KEV.
  • Mon 29 Jun, 03:01 UTC. SecurityOnline. Cisco Unified CM RCE Flaw Exploited in the Wild as PoC Code Goes Public. Cites a CVE in CISA KEV.
  • Thu 2 Jul, 11:12 UTC. SecurityWeek. Cisco Warns of Exploit in Manager SSRF Flaw CVE-2026-20230. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 16 articles as a list
  1. Thu 4 JunDay 04
    1. Cisco Unified CM SSRF flaw exposes systems to remote takeover03:51 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
    2. Cisco patches CVE-2026-20230 UC Manager flaw enabling root access08:51 · SecurityWeek · Known exploited CVE
    3. Cisco Fixes CVE-2026-20230 SSRF Flaw in Unified CM, Root Risk.13:50 · Security Affairs · Known exploited CVE
    4. Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public17:11 · The Hacker News · Known exploited CVE
  2. Fri 5 JunDay 11
    1. Cisco patches SSRF flaw in Unified CM enabling root access13:01 · SOCRadar · Known exploited CVE

  3. Quiet for 3 weeks

    Wed 24 JunDay 202
    1. Cisco Unified CM flaw lets hackers gain root access via SSRF05:50 · SecurityWeek · Picked up again · Known exploited CVE
    2. Cisco CUCM CVE-2026-20230 SSRF flaw lets attackers gain root14:10 · Security Affairs · Known exploited CVE
  4. Thu 25 JunDay 212
    1. Cisco Manager SSRF Flaw Exploited, CISA Adds CVE‑2026‑20230 to KEV22:22 · CISA · official · CISA alert · Known exploited CVE
    2. Cisco CUCM flaw allows hackers to gain root access in 24 hours22:40 · Dark Reading · Known exploited CVE
  5. Fri 26 JunDay 225
    1. Cisco and PTC flaws under active attack, CISA adds to KEV list03:31 · SecurityOnline · Known exploited CVE
    2. PTC Windchill flaw spotted; Claude Fable 5 hints at AWS return05:40 · SecurityOnline · Known exploited CVE
    3. CISA Adds Cisco UC Manager SSRF Flaw to KEV Catalog06:19 · CISA · official · Known exploited CVE · This article, 12th of 16
    Show 2 more from 26 Jun
    1. CISA adds critical PTC Windchill, Cisco UC flaws to KEV list11:31 · Security Affairs · Known exploited CVE
    2. Cisco SD-WAN Zero-Day Exploited in Attacks14:21 · SecurityOnline · Known exploited CVE

  6. Quiet for 3 days

    Mon 29 JunDay 251
    1. Cisco Unified CM RCE Flaw Exploited in the Wild as PoC Code Goes Public03:01 · SecurityOnline · Picked up again · Known exploited CVE

  7. Quiet for 3 days

    Thu 2 JulDay 281
    1. Cisco Warns of Exploit in Manager SSRF Flaw CVE-2026-2023011:12 · SecurityWeek · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in