Under Attack: Critical Cisco RCE (CVE-2026-20045) Exploited in the Wild

Cisco has issued an urgent warning about a critical remote code execution vulnerability, CVE-2026-20045, in its core communications software that is currently being exploited in the wild. The flaw targets the web-based management interface and allows unauthenticated attackers to seize control of affected devices, potentially escalating to root access. It affects Cisco Unified Communications Manager, Unified CM SME, Unified CM IM & Presence Service, Unity Connection and Webex Calling Dedicated Instance.

The vulnerability carried a CVSS base score of 8.2 but is now classified by Cisco as Critical, with the reasoning that exploitation could allow an attacker to elevate privileges to root. According to Cisco Security Advisory, exploitation can occur without logging in by sending a sequence of crafted HTTP requests to the web interface.

Cisco has released fixed software updates for versions 14 and 15, and version 12.5 users must migrate to a fixed release, with a strong recommendation for customers to upgrade immediately.