Cisco Unified CM Flaw Lets Remote Attackers Launch SSRF Attacks and Write Files

Cisco has patched a critical vulnerability in Cisco Unified Communications Manager and Unified Communications Manager Session Management Edition that can let a remote, unauthenticated attacker launch server-side request forgery attacks and write files to the underlying operating system.

The flaw is tracked as CVE-2026-20230 and is detailed in Cisco’s Unified Communications Manager advisory. Cisco assigned the issue a CVSS v3.1 score of 8.6, but rated the advisory Critical because successful exploitation can lead to root-level privilege escalation.

The vulnerability affects Cisco Unified CM and Unified CM SME only when the Cisco WebDialer Web Service is enabled. Cisco says WebDialer is disabled by default, which limits exposure but does not remove the need for urgent checks in environments that use the feature.

The flaw sits in the WebDialer service

CVE-2026-20230 exists because Unified CM and Unified CM SME do not properly validate certain HTTP requests processed through WebDialer. An attacker can send a crafted request to an affected device and force the server to make requests in a way it should not.

This is a server-side request forgery, or SSRF, issue. The OWASP SSRF guidance explains that SSRF flaws let attackers abuse a server into reaching internal or external resources on their behalf, often bypassing normal network boundaries.

In this case, Cisco says successful exploitation can allow arbitrary file creation on the underlying operating system. Those files could later help an attacker escalate privileges to root, which would give them full control over the affected call-control server.

Vulnerability detail	Information
CVE	CVE-2026-20230
Affected products	Cisco Unified CM and Cisco Unified CM SME
Component	Cisco WebDialer Web Service
Weakness type	Server-side request forgery, CWE-918
Attack requirements	Remote network access, no authentication, WebDialer enabled
Potential impact	File write and possible privilege escalation to root

Why root access on Unified CM is serious

Cisco Unified CM is a core platform for enterprise voice, video, and collaboration services. It manages call routing, device registration, telephony features, and other communications functions across many large organizations.

If attackers gain root access on a Unified CM server, they may be able to tamper with configuration files, disrupt call-control services, create persistence, inspect sensitive service data, or use the compromised system as a foothold in the wider network.

BleepingComputer reported that Cisco released updates for the flaw and warned that public proof-of-concept exploit code was available. That detail increases urgency because public exploit code can shorten the time between patch release and real-world attack attempts.

• The attack can be launched remotely over the network.
• The attacker does not need valid credentials.
• The flaw has low attack complexity.
• WebDialer must be enabled for exploitation.
• Successful exploitation can create files that help attackers reach root privileges.

Cisco says there is no full workaround

Cisco says there are no workarounds that fully address CVE-2026-20230. The complete fix is to upgrade to a fixed software release or apply the relevant version-specific patch.

According to the Cisco security advisory, Unified CM and Unified CM SME 14 are fixed in 14SU6. For release 15, Cisco lists 15SU5, expected in September 2026, or a version-specific COP patch.

Administrators who cannot patch immediately can reduce exposure by disabling the Cisco WebDialer Web Service if the business does not need it. Cisco says customers can check the status from Cisco Unified Serviceability under Control Center – Feature Services in the CTI Services section.

Cisco Unified CM or SME release	First fixed release
Release 14	14SU6
Release 15	15SU5, expected September 2026, or COP patch

PoC code is public, and exploitation claims have appeared

Cisco PSIRT said it was aware of proof-of-concept exploit code for the vulnerability. At the time of Cisco’s advisory, the company said it was not aware of malicious use of the flaw.

After the advisory, SecurityWeek reported that exploit intelligence firm Defused had seen evidence of exploitation attempts against decoy systems. Cisco told the publication on June 24, 2026, that PSIRT was still not aware of malicious use of the vulnerability.

This creates a familiar risk window for defenders. Even if confirmed exploitation remains limited, public exploit details can help attackers scan for exposed systems, test the WebDialer endpoint, and attempt file-write payloads against unpatched deployments.

How administrators can reduce risk

Organizations should first determine whether WebDialer is enabled. If the service is not needed, disabling it can reduce exposure while patching plans move forward.

Teams should also restrict access to Unified CM and Unified CM SME interfaces from untrusted networks. These systems should not be broadly reachable from the internet, and management access should sit behind trusted administrative paths.

The BleepingComputer coverage also notes Cisco’s guidance for checking and disabling WebDialer through Cisco Unified Serviceability. That step can help teams confirm whether they have an exposed configuration before they deploy fixed software.

• Upgrade affected Unified CM and Unified CM SME systems to a fixed release.
• Apply the correct COP patch where Cisco provides one for the installed release.
• Disable Cisco WebDialer Web Service if it is not required.
• Restrict Unified CM access to trusted administrative networks.
• Monitor WebDialer endpoints for unusual HTTP requests.
• Watch for unexpected file creation on Unified CM servers.
• Review privileged access and configuration changes after patching.

The broader lesson is that collaboration infrastructure should receive the same urgency as firewalls, VPNs, identity servers, and other edge or core systems. A flaw in call-control infrastructure can become more than a phone-system issue if attackers use it to gain root access and move deeper into the environment.

SSRF issues deserve special attention because they often abuse trusted server-side behavior rather than a simple exposed endpoint. The OWASP SSRF overview recommends strong input validation, network segmentation, and controls that prevent server-side components from reaching sensitive internal resources.

For now, the most important action is clear: check whether WebDialer is enabled, deploy Cisco’s fixed software, and investigate any suspicious HTTP or file-write activity around Unified CM systems. The SecurityWeek report shows why teams should not wait for broad exploitation before acting.

FAQ