Cisco fixed actively exploited Unified Communications zero day

Cisco patched a critical zero-day remote code execution flaw, tracked as CVE-2026-20045 (CVSS 8.2), in Unified Communications and Webex Calling that is actively exploited in the wild. An unauthenticated, remote attacker can exploit the flaw to execute arbitrary commands on the underlying operating system of an affected device.

The vulnerability affects Cisco Unified CM, Unified CM IM&P, Unified CM SME, Unity Connection, and Webex Calling Dedicated Instance, with patches and fixed releases provided for multiple versions. The advisory notes the flaw is due to improper validation of user-supplied input in HTTP requests, and a successful exploit could give the attacker user-level access to the OS and potentially elevate to root, according to the Cisco PSIRT advisory.

Cisco also references an earlier mid‑January fix for CVE-2026-20029 in Identity Services Engine (ISE) and ISE‑PIC after a public PoC exploit was disclosed, with the vulnerability residing in the licensing feature due to improper XML parsing. The company urges customers to upgrade to fixed releases, as there are no workarounds addressing this vulnerability.