U.S. CISA adds a flaw in Cisco Unified Communications products to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a Cisco Unified Communications vulnerability, tracked as CVE-2026-20045 with a CVSS score of 8.2, to its Known Exploited Vulnerabilities catalog. Cisco patched a critical zero‑day remote code execution flaw that was actively exploited in attacks, with an unauthenticated, remote attacker able to run arbitrary commands on an affected device’s operating system.

The bug affected Cisco Unified CM, Unified CM IM&P, Unified CM SME, Unity Connection, and Webex Calling Dedicated Instance, and the Cisco PSIRT notes that there are no workarounds addressing the vulnerability. The advisory states that an attacker could obtain user‑level access to the underlying OS and elevate privileges to root after exploiting crafted HTTP requests to the web‑based management interface, and CISA emphasises the need for a fixed software release.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies must address the vulnerabilities by their due date to protect networks against exploitation, while private organisations are urged to review the KEV catalog and apply fixes by 11 February 2026.