Cisco Fixes Actively Exploited Zero-Day CVE-2026-20045 in Unified CM and Webex

Cisco has issued patches for CVE-2026-20045, a critical zero-day in Unified CM products and Webex Calling Dedicated Instance that has been actively exploited in the wild, with a CVSS score of 8.2. The flaw stems from improper validation of user-supplied input in HTTP requests and could let an unauthenticated attacker run arbitrary commands on the underlying operating system by crafted requests to the device’s web management interface, potentially gaining root privileges.

Affected products include Unified CM, Unified CM SME, Unified CM IM&P, Unity Connection, and Webex Calling Dedicated Instance, with fixes delivered through various release paths such as Release 12.5, Release 14 (14SU5 or the patch ciscocm.V14SU4a_CSCwr21851_remote_code_v1.cop.sha512), Release 15 (15SU4 or the corresponding patch files), and similar options for Unity Connection.

Cisco notes it is aware of attempted exploitation in the wild and urges customers to upgrade to a fixed release, as there are no workarounds. The U.S. Cybersecurity and Infrastructure Security Agency has added CVE-2026-20045 to the Known Exploited Vulnerabilities catalog, requiring Federal Civilian Executive Branch agencies to apply the fixes by 11 February 2026.

An external researcher is credited with discovering and reporting the bug, and this disclosure follows Cisco’s earlier patching activity for another active flaw (CVE-2025-20393) affecting AsyncOS Software.