Cisco Unified CM SSRF flaw exposes systems to remote takeover

A critical vulnerability in Cisco Unified CM, identified as CVE-2026-20230, allows unauthenticated remote attackers to perform server-side request forgery (SSRF) attacks. This flaw has a CVSS score of 8.6 and poses significant downstream risks, potentially leading to a full system takeover. Although the vulnerability primarily affects systems with the WebDialer service enabled, which is disabled by default, organizations using this feature are at immediate risk due to the public disclosure of exploit code.

Administrators are urged to upgrade to secure software versions immediately or disable the vulnerable service temporarily if updates cannot be applied. Continuous monitoring of server traffic for unusual HTTP patterns is also recommended to mitigate possible attacks.

CVE-2026-20230 coverage
Published (UTC)	Outlet	Headline
Thu 4 Jun · 03:51 UTC	SecurityOnline	Cisco Unified CM SSRF flaw exposes systems to remote takeover (this article)
Thu 4 Jun · 08:51 UTC	SecurityWeek	Cisco patches CVE-2026-20230 UC Manager flaw enabling root access
Thu 4 Jun · 13:50 UTC	Security Affairs	Cisco Fixes CVE-2026-20230 SSRF Flaw in Unified CM, Root Risk.
Thu 4 Jun · 17:11 UTC	The Hacker News	Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public
Fri 5 Jun · 13:01 UTC	SOCRadar	Cisco patches SSRF flaw in Unified CM enabling root access
Wed 24 Jun · 05:50 UTC	SecurityWeek	Cisco Unified CM flaw lets hackers gain root access via SSRF
Wed 24 Jun · 14:10 UTC	Security Affairs	Cisco CUCM CVE-2026-20230 SSRF flaw lets attackers gain root
Thu 25 Jun · 22:22 UTC	CISA	Cisco Manager SSRF Flaw Exploited, CISA Adds CVE‑2026‑20230 to KEV
Thu 25 Jun · 22:40 UTC	Dark Reading	Cisco CUCM flaw allows hackers to gain root access in 24 hours
Fri 26 Jun · 03:31 UTC	SecurityOnline	Cisco and PTC flaws under active attack, CISA adds to KEV list
Fri 26 Jun · 05:40 UTC	SecurityOnline	PTC Windchill flaw spotted; Claude Fable 5 hints at AWS return
Fri 26 Jun · 06:19 UTC	CISA	CISA Adds Cisco UC Manager SSRF Flaw to KEV Catalog
Fri 26 Jun · 11:31 UTC	Security Affairs	CISA adds critical PTC Windchill, Cisco UC flaws to KEV list
Fri 26 Jun · 14:21 UTC	SecurityOnline	Cisco SD-WAN Zero-Day Exploited in Attacks
Mon 29 Jun · 03:01 UTC	SecurityOnline	Cisco Unified CM RCE Flaw Exploited in the Wild as PoC Code Goes Public
Thu 2 Jul · 11:12 UTC	SecurityWeek	Cisco Warns of Exploit in Manager SSRF Flaw CVE-2026-20230

CVE-2026-20230 coverage

Published (UTC)

Outlet

Headline

Thu 4 Jun · 03:51 UTC

SecurityOnline

Cisco Unified CM SSRF flaw exposes systems to remote takeover (this article)

Thu 4 Jun · 08:51 UTC

SecurityWeek

Cisco patches CVE-2026-20230 UC Manager flaw enabling root access

Thu 4 Jun · 13:50 UTC

Security Affairs