Skip to content
OriginalSign in

CISA KEV alertCyberSIXT

Cisco Manager SSRF Flaw Exploited, CISA Adds CVE‑2026‑20230 to KEV

Part of the CVE-2026-20230 story · since 4 Jun

Quiet for 19 weekslast report 2 Jul16 articles7 outlets
4 Jun · SecurityOnline first23 Aug19 Sep16 OctNowThis article8th of 16
  • Thu 4 Jun, 03:51 UTC. SecurityOnline, first report. Cisco Unified CM SSRF flaw exposes systems to remote takeover. Cites a CVE in CISA KEV.
  • Thu 4 Jun, 08:51 UTC. SecurityWeek, its first report on the story. Cisco patches CVE-2026-20230 UC Manager flaw enabling root access. Cites a CVE in CISA KEV.
  • Thu 4 Jun, 13:50 UTC. Security Affairs, its first report on the story. Cisco Fixes CVE-2026-20230 SSRF Flaw in Unified CM, Root Risk.. Cites a CVE in CISA KEV.
  • Thu 4 Jun, 17:11 UTC. The Hacker News, its first report on the story. Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public. Cites a CVE in CISA KEV.
  • Fri 5 Jun, 13:01 UTC. SOCRadar, its first report on the story. Cisco patches SSRF flaw in Unified CM enabling root access. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 05:50 UTC. SecurityWeek. Cisco Unified CM flaw lets hackers gain root access via SSRF. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 14:10 UTC. Security Affairs. Cisco CUCM CVE-2026-20230 SSRF flaw lets attackers gain root. Cites a CVE in CISA KEV.
  • Thu 25 Jun, 22:22 UTC. CISA, its first report on the story. Cisco Manager SSRF Flaw Exploited, CISA Adds CVE‑2026‑20230 to KEV. Cites a CVE in CISA KEV. This article, 8th of 16.
  • Thu 25 Jun, 22:40 UTC. Dark Reading, its first report on the story. Cisco CUCM flaw allows hackers to gain root access in 24 hours. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 03:31 UTC. SecurityOnline. Cisco and PTC flaws under active attack, CISA adds to KEV list. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 05:40 UTC. SecurityOnline. PTC Windchill flaw spotted; Claude Fable 5 hints at AWS return. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 06:19 UTC. CISA. CISA Adds Cisco UC Manager SSRF Flaw to KEV Catalog. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 11:31 UTC. Security Affairs. CISA adds critical PTC Windchill, Cisco UC flaws to KEV list. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 14:21 UTC. SecurityOnline. Cisco SD-WAN Zero-Day Exploited in Attacks. Cites a CVE in CISA KEV.
  • Mon 29 Jun, 03:01 UTC. SecurityOnline. Cisco Unified CM RCE Flaw Exploited in the Wild as PoC Code Goes Public. Cites a CVE in CISA KEV.
  • Thu 2 Jul, 11:12 UTC. SecurityWeek. Cisco Warns of Exploit in Manager SSRF Flaw CVE-2026-20230. Cites a CVE in CISA KEV.

CISA has added CVE‑2026‑20230 to its Known Exploited Vulnerabilities catalogue, affecting Cisco Unified Communications Manager and Unified Communications Manager Session Management Edition. The vulnerability is a server‑side request forgery (SSRF) flaw that lets an unauthenticated, remote attacker write files to the underlying operating system, which could later be used to gain root privileges.

The SSRF vulnerability can be exploited over the network without authentication, allowing an attacker to trigger outbound requests from the affected Unified CM server and write arbitrary files to the host filesystem. This capability can be chained to achieve elevated access. The flaw carries a CVSS v3.1 base score of 8.6, rated as HIGH. Cisco has not yet released a patch, and patch status remains unknown.

Active exploitation has been confirmed, which is why the entry appears in the KEV catalogue. No known ransomware campaign has been linked to this CVE at present. CISA has set a remediation deadline of 26 June 2026 for federal civilian executive branch agencies to address the issue.

CISA’s required action is: “Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26‑04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26‑04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.

Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26‑04 patching guidelines.” While the directive binds FCEB agencies, all organisations should review their exposure to Unified Communications Manager and apply any available mitigations promptly.

For full details, consult the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-20230 and the CISA KEV catalogue.

How the story developed

All 16 articles
Quiet for 19 weekslast report 2 Jul16 articles7 outlets

16 articles from 7 outlets since 4 Jun. Quiet since 2 Jul. This was the 8th report, 22 days after the first.

Now4 Jun81013161922252824First reportSecurityOnline · 4 Jun, 03:51This article8th of 16 · day 21
  • Thu 4 Jun, 03:51 UTC. SecurityOnline, first report. Cisco Unified CM SSRF flaw exposes systems to remote takeover. Cites a CVE in CISA KEV.
  • Thu 4 Jun, 08:51 UTC. SecurityWeek, its first report on the story. Cisco patches CVE-2026-20230 UC Manager flaw enabling root access. Cites a CVE in CISA KEV.
  • Thu 4 Jun, 13:50 UTC. Security Affairs, its first report on the story. Cisco Fixes CVE-2026-20230 SSRF Flaw in Unified CM, Root Risk.. Cites a CVE in CISA KEV.
  • Thu 4 Jun, 17:11 UTC. The Hacker News, its first report on the story. Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public. Cites a CVE in CISA KEV.
  • Fri 5 Jun, 13:01 UTC. SOCRadar, its first report on the story. Cisco patches SSRF flaw in Unified CM enabling root access. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 05:50 UTC. SecurityWeek. Cisco Unified CM flaw lets hackers gain root access via SSRF. Cites a CVE in CISA KEV.
  • Wed 24 Jun, 14:10 UTC. Security Affairs. Cisco CUCM CVE-2026-20230 SSRF flaw lets attackers gain root. Cites a CVE in CISA KEV.
  • Thu 25 Jun, 22:22 UTC. CISA, its first report on the story. Cisco Manager SSRF Flaw Exploited, CISA Adds CVE‑2026‑20230 to KEV. Cites a CVE in CISA KEV. This article, 8th of 16.
  • Thu 25 Jun, 22:40 UTC. Dark Reading, its first report on the story. Cisco CUCM flaw allows hackers to gain root access in 24 hours. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 03:31 UTC. SecurityOnline. Cisco and PTC flaws under active attack, CISA adds to KEV list. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 05:40 UTC. SecurityOnline. PTC Windchill flaw spotted; Claude Fable 5 hints at AWS return. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 06:19 UTC. CISA. CISA Adds Cisco UC Manager SSRF Flaw to KEV Catalog. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 11:31 UTC. Security Affairs. CISA adds critical PTC Windchill, Cisco UC flaws to KEV list. Cites a CVE in CISA KEV.
  • Fri 26 Jun, 14:21 UTC. SecurityOnline. Cisco SD-WAN Zero-Day Exploited in Attacks. Cites a CVE in CISA KEV.
  • Mon 29 Jun, 03:01 UTC. SecurityOnline. Cisco Unified CM RCE Flaw Exploited in the Wild as PoC Code Goes Public. Cites a CVE in CISA KEV.
  • Thu 2 Jul, 11:12 UTC. SecurityWeek. Cisco Warns of Exploit in Manager SSRF Flaw CVE-2026-20230. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 16 articles as a list
  1. Thu 4 JunDay 04
    1. Cisco Unified CM SSRF flaw exposes systems to remote takeover03:51 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
    2. Cisco patches CVE-2026-20230 UC Manager flaw enabling root access08:51 · SecurityWeek · Known exploited CVE
    3. Cisco Fixes CVE-2026-20230 SSRF Flaw in Unified CM, Root Risk.13:50 · Security Affairs · Known exploited CVE
    4. Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public17:11 · The Hacker News · Known exploited CVE
  2. Fri 5 JunDay 11
    1. Cisco patches SSRF flaw in Unified CM enabling root access13:01 · SOCRadar · Known exploited CVE

  3. Quiet for 3 weeks

    Wed 24 JunDay 202
    1. Cisco Unified CM flaw lets hackers gain root access via SSRF05:50 · SecurityWeek · Picked up again · Known exploited CVE
    2. Cisco CUCM CVE-2026-20230 SSRF flaw lets attackers gain root14:10 · Security Affairs · Known exploited CVE
  4. Thu 25 JunDay 212
    1. Cisco Manager SSRF Flaw Exploited, CISA Adds CVE‑2026‑20230 to KEV22:22 · CISA · official · CISA alert · Known exploited CVE · This article, 8th of 16
    2. Cisco CUCM flaw allows hackers to gain root access in 24 hours22:40 · Dark Reading · Known exploited CVE
  5. Fri 26 JunDay 225
    1. Cisco and PTC flaws under active attack, CISA adds to KEV list03:31 · SecurityOnline · Known exploited CVE
    2. PTC Windchill flaw spotted; Claude Fable 5 hints at AWS return05:40 · SecurityOnline · Known exploited CVE
    3. CISA Adds Cisco UC Manager SSRF Flaw to KEV Catalog06:19 · CISA · official · Known exploited CVE
    Show 2 more from 26 Jun
    1. CISA adds critical PTC Windchill, Cisco UC flaws to KEV list11:31 · Security Affairs · Known exploited CVE
    2. Cisco SD-WAN Zero-Day Exploited in Attacks14:21 · SecurityOnline · Known exploited CVE

  6. Quiet for 3 days

    Mon 29 JunDay 251
    1. Cisco Unified CM RCE Flaw Exploited in the Wild as PoC Code Goes Public03:01 · SecurityOnline · Picked up again · Known exploited CVE

  7. Quiet for 3 days

    Thu 2 JulDay 281
    1. Cisco Warns of Exploit in Manager SSRF Flaw CVE-2026-2023011:12 · SecurityWeek · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in