Skip to content
OriginalSign in
Image: Dark Reading

Dark ReadingJai Vijayan

Cisco CUCM flaw allows hackers to gain root access in 24 hours

Part of the CVE-2026-20230 story · since 4 Jun

Quiet for 19 weekslast report 2 Jul16 articles7 outlets
4 Jun · SecurityOnline first23 Aug19 Sep16 OctNowThis article9th of 16
  • Thu 4 Jun, 03:51 UTC. SecurityOnline, first report. Cisco Unified CM SSRF flaw exposes systems to remote takeover. Cites a CVE in CISA KEV.
  • Thu 4 Jun, 08:51 UTC. SecurityWeek, its first report on the story. Cisco patches CVE-2026-20230 UC Manager flaw enabling root access. Cites a CVE in CISA KEV.
  • Thu 4 Jun, 13:50 UTC. Security Affairs, its first report on the story. Cisco Fixes CVE-2026-20230 SSRF Flaw in Unified CM, Root Risk.. Cites a CVE in CISA KEV.
  • Thu 4 Jun, 17:11 UTC. The Hacker News, its first report on the story. Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public. Cites a CVE in CISA KEV.
  • Fri 5 Jun, 13:01 UTC. SOCRadar, its first report on the story. Cisco patches SSRF flaw in Unified CM enabling root access. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 05:50 UTC. SecurityWeek. Cisco Unified CM flaw lets hackers gain root access via SSRF. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 14:10 UTC. Security Affairs. Cisco CUCM CVE-2026-20230 SSRF flaw lets attackers gain root. Cites a CVE in CISA KEV.
  • Thu 25 Jun, 22:22 UTC. CISA, its first report on the story. Cisco Manager SSRF Flaw Exploited, CISA Adds CVE‑2026‑20230 to KEV. Cites a CVE in CISA KEV.
  • Thu 25 Jun, 22:40 UTC. Dark Reading, its first report on the story. Cisco CUCM flaw allows hackers to gain root access in 24 hours. Cites a CVE in CISA KEV. This article, 9th of 16.
  • Fri 26 Jun, 03:31 UTC. SecurityOnline. Cisco and PTC flaws under active attack, CISA adds to KEV list. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 05:40 UTC. SecurityOnline. PTC Windchill flaw spotted; Claude Fable 5 hints at AWS return. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 06:19 UTC. CISA. CISA Adds Cisco UC Manager SSRF Flaw to KEV Catalog. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 11:31 UTC. Security Affairs. CISA adds critical PTC Windchill, Cisco UC flaws to KEV list. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 14:21 UTC. SecurityOnline. Cisco SD-WAN Zero-Day Exploited in Attacks. Cites a CVE in CISA KEV.
  • Mon 29 Jun, 03:01 UTC. SecurityOnline. Cisco Unified CM RCE Flaw Exploited in the Wild as PoC Code Goes Public. Cites a CVE in CISA KEV.
  • Thu 2 Jul, 11:12 UTC. SecurityWeek. Cisco Warns of Exploit in Manager SSRF Flaw CVE-2026-20230. Cites a CVE in CISA KEV.

A critical vulnerability in Cisco Unified Communications Manager (CUCM), tracked as CVE-2026-20230, has been weaponized by attackers within 24 hours of a proof-of-concept (PoC) release. This server-side request forgery (SSRF) flaw allows unauthenticated attackers to gain root access by exploiting the WebDialer service, which is disabled by default but enables calling from web browsers. Cisco had recently released patches on June 3, urging organizations to treat this as a critical issue.

Researchers from SSD Secure Disclosure and Defused reported that full control of CUCM systems could be gained through a specific attack chain involving crafted HTTP requests, malicious file uploads, and the use of a second JSP web shell for remote code execution. Organizations with the vulnerable software should assume compromise and implement Cisco's mitigations or disable the WebDialer immediately.

How the story developed

All 16 articles
Quiet for 19 weekslast report 2 Jul16 articles7 outlets

16 articles from 7 outlets since 4 Jun. Quiet since 2 Jul. This was the 9th report, 22 days after the first.

Now4 Jun81013161922252824First reportSecurityOnline · 4 Jun, 03:51This article9th of 16 · day 21
  • Thu 4 Jun, 03:51 UTC. SecurityOnline, first report. Cisco Unified CM SSRF flaw exposes systems to remote takeover. Cites a CVE in CISA KEV.
  • Thu 4 Jun, 08:51 UTC. SecurityWeek, its first report on the story. Cisco patches CVE-2026-20230 UC Manager flaw enabling root access. Cites a CVE in CISA KEV.
  • Thu 4 Jun, 13:50 UTC. Security Affairs, its first report on the story. Cisco Fixes CVE-2026-20230 SSRF Flaw in Unified CM, Root Risk.. Cites a CVE in CISA KEV.
  • Thu 4 Jun, 17:11 UTC. The Hacker News, its first report on the story. Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public. Cites a CVE in CISA KEV.
  • Fri 5 Jun, 13:01 UTC. SOCRadar, its first report on the story. Cisco patches SSRF flaw in Unified CM enabling root access. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 05:50 UTC. SecurityWeek. Cisco Unified CM flaw lets hackers gain root access via SSRF. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 14:10 UTC. Security Affairs. Cisco CUCM CVE-2026-20230 SSRF flaw lets attackers gain root. Cites a CVE in CISA KEV.
  • Thu 25 Jun, 22:22 UTC. CISA, its first report on the story. Cisco Manager SSRF Flaw Exploited, CISA Adds CVE‑2026‑20230 to KEV. Cites a CVE in CISA KEV.
  • Thu 25 Jun, 22:40 UTC. Dark Reading, its first report on the story. Cisco CUCM flaw allows hackers to gain root access in 24 hours. Cites a CVE in CISA KEV. This article, 9th of 16.
  • Fri 26 Jun, 03:31 UTC. SecurityOnline. Cisco and PTC flaws under active attack, CISA adds to KEV list. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 05:40 UTC. SecurityOnline. PTC Windchill flaw spotted; Claude Fable 5 hints at AWS return. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 06:19 UTC. CISA. CISA Adds Cisco UC Manager SSRF Flaw to KEV Catalog. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 11:31 UTC. Security Affairs. CISA adds critical PTC Windchill, Cisco UC flaws to KEV list. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 14:21 UTC. SecurityOnline. Cisco SD-WAN Zero-Day Exploited in Attacks. Cites a CVE in CISA KEV.
  • Mon 29 Jun, 03:01 UTC. SecurityOnline. Cisco Unified CM RCE Flaw Exploited in the Wild as PoC Code Goes Public. Cites a CVE in CISA KEV.
  • Thu 2 Jul, 11:12 UTC. SecurityWeek. Cisco Warns of Exploit in Manager SSRF Flaw CVE-2026-20230. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 16 articles as a list
  1. Thu 4 JunDay 04
    1. Cisco Unified CM SSRF flaw exposes systems to remote takeover03:51 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
    2. Cisco patches CVE-2026-20230 UC Manager flaw enabling root access08:51 · SecurityWeek · Known exploited CVE
    3. Cisco Fixes CVE-2026-20230 SSRF Flaw in Unified CM, Root Risk.13:50 · Security Affairs · Known exploited CVE
    4. Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public17:11 · The Hacker News · Known exploited CVE
  2. Fri 5 JunDay 11
    1. Cisco patches SSRF flaw in Unified CM enabling root access13:01 · SOCRadar · Known exploited CVE

  3. Quiet for 3 weeks

    Wed 24 JunDay 202
    1. Cisco Unified CM flaw lets hackers gain root access via SSRF05:50 · SecurityWeek · Picked up again · Known exploited CVE
    2. Cisco CUCM CVE-2026-20230 SSRF flaw lets attackers gain root14:10 · Security Affairs · Known exploited CVE
  4. Thu 25 JunDay 212
    1. Cisco Manager SSRF Flaw Exploited, CISA Adds CVE‑2026‑20230 to KEV22:22 · CISA · official · CISA alert · Known exploited CVE
    2. Cisco CUCM flaw allows hackers to gain root access in 24 hours22:40 · Dark Reading · Known exploited CVE · This article, 9th of 16
  5. Fri 26 JunDay 225
    1. Cisco and PTC flaws under active attack, CISA adds to KEV list03:31 · SecurityOnline · Known exploited CVE
    2. PTC Windchill flaw spotted; Claude Fable 5 hints at AWS return05:40 · SecurityOnline · Known exploited CVE
    3. CISA Adds Cisco UC Manager SSRF Flaw to KEV Catalog06:19 · CISA · official · Known exploited CVE
    Show 2 more from 26 Jun
    1. CISA adds critical PTC Windchill, Cisco UC flaws to KEV list11:31 · Security Affairs · Known exploited CVE
    2. Cisco SD-WAN Zero-Day Exploited in Attacks14:21 · SecurityOnline · Known exploited CVE

  6. Quiet for 3 days

    Mon 29 JunDay 251
    1. Cisco Unified CM RCE Flaw Exploited in the Wild as PoC Code Goes Public03:01 · SecurityOnline · Picked up again · Known exploited CVE

  7. Quiet for 3 days

    Thu 2 JulDay 281
    1. Cisco Warns of Exploit in Manager SSRF Flaw CVE-2026-2023011:12 · SecurityWeek · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in