CVE-2026-20045 Actively Exploited Cisco Unified Communications Zero-Day Explained

In late January 2026, Cisco released emergency patches for CVE-2026-20045, a critical remote code execution vulnerability affecting its Unified Communications products, with the issue confirmed as actively exploited in real-world attacks.

The flaw affects multiple Cisco Unified Communications solutions, including Unified CM, SME, IM and Presence Service, Unity Connection and Webex Calling Dedicated Instance, and it allows unauthenticated attackers to trigger arbitrary command execution via specially crafted HTTP requests to a device’s web-based management interface. Cisco assigned a CVSS v3.1 score of 8.2, and while described as Critical due to privilege escalation to root, the vulnerability remains exploitable without valid credentials. The U.S.

Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-20045 to its Known Exploited Vulnerabilities (KEV) Catalog, validating active exploitation and setting remediation deadlines for federal agencies by 11 February 2026. Public reports have not attributed the activity to a specific threat group, but exploitation involves targeting exposed management interfaces and unauthenticated HTTP access.

SOCRadar notes that patches address the issue and emphasises the importance of limiting exposure and monitoring for unusual HTTP requests targeting these services.