CVE-2026-20045

What it actually does

CVE-2026-20045 is an unauthenticated remote command injection vulnerability in the web-based management interfaces of Cisco Unified Communications Manager, Unified CM Session Management Edition, Unified CM IM & Presence Service, Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance. Improper validation of user-controlled HTTP request data allows an attacker to inject operating-system commands that execute on the underlying appliance. Successful exploitation can provide user-level operating-system access and may allow follow-on privilege escalation to root, giving the attacker broad control over the affected communications platform.

Why it matters to the business

Compromise of a Cisco unified communications platform can expose sensitive call, voicemail, directory, authentication, and configuration data, and can allow attackers to tamper with communications infrastructure used for voice, messaging, and collaboration. Because this vulnerability is unauthenticated, remotely reachable, listed in CISA KEV, and reported as actively exploited in the wild, exposed systems should be treated as high-priority remediation targets. The CISA KEV due date of 2026-02-11 has passed, increasing compliance and operational risk for organizations that still run affected versions.

How an attack unfolds

An attacker first identifies an internet-reachable or otherwise network-accessible Cisco unified communications management interface. The attacker then sends a sequence of crafted HTTP requests containing malicious input designed to bypass insufficient validation and reach a vulnerable server-side code path. When processed, the malicious input is interpreted as operating-system commands rather than ordinary request data, allowing the attacker to execute commands with the privileges of the affected service account. From there, the attacker can perform reconnaissance on the appliance, read sensitive files and application data accessible to that account, deploy tooling or web-accessible artifacts where permitted, and attempt local privilege escalation to root. With root-level control, the attacker may persist, collect credentials, manipulate communications configuration, pivot to adjacent management networks, or use the compromised communications system as a trusted foothold.

How to fix it

Upgrade affected Cisco unified communications products to a Cisco fixed release that addresses this advisory. No fixed version list was provided in the input, so administrators should consult the relevant Cisco security advisory and product-specific release notes for Cisco Unified Communications Manager, Unified CM SME, Unified CM IM & Presence Service, Cisco Unity Connection, and Webex Calling Dedicated Instance. If immediate upgrade is not possible, restrict access to the web-based management interface to trusted administrative networks only, block direct internet exposure, enforce VPN or bastion access, apply management-plane ACLs, monitor for suspicious HTTP requests, and reduce unnecessary administrative services. Treat network isolation as a temporary mitigation only; it does not remove the vulnerable code path.

How to confirm the fix worked

Confirm remediation by verifying the installed product version against Cisco’s fixed-release guidance for each affected product and node in the cluster. Validate that all publisher, subscriber, IM & Presence, Unity Connection, and related dedicated-instance components have been upgraded, not only the primary node. Confirm that the management interface is not internet-exposed and is reachable only from approved administrative networks. Review vulnerability scanner results, Cisco advisory compliance checks, and configuration management records for affected versions. Where safe and authorized, perform non-destructive testing to confirm crafted command-injection payloads are rejected and do not result in command execution or out-of-band callbacks.

Typical attack path

1. Scan for exposed Cisco Unified Communications Manager, Unified CM IM & Presence, Unity Connection, or related Cisco unified communications web management interfaces.
2. Fingerprint the product and version using HTTP headers, login pages, static resources, or management interface behavior.
3. Send crafted unauthenticated HTTP requests containing command-injection metacharacters or encoded shell syntax to the vulnerable management interface.
4. Confirm command execution by using low-impact commands or observing timing, DNS, HTTP, or other out-of-band callbacks.
5. Run reconnaissance commands to identify the appliance role, local users, network configuration, accessible files, and service privileges.
6. Attempt to elevate from user-level operating-system access to root.
7. Collect sensitive configuration, directory, voicemail, credential, or call-management data, or establish persistence.
8. Use the compromised communications platform to pivot, monitor, or disrupt voice and collaboration services.

How to detect it

Review Cisco unified communications HTTP access logs, Tomcat/application logs, reverse-proxy logs, firewall logs, EDR process telemetry, DNS logs, and outbound proxy logs for signs of crafted unauthenticated requests to management interfaces followed by operating-system command execution. Focus on requests containing shell metacharacters, encoded command separators, command-substitution syntax, or common reconnaissance commands. Correlate suspicious HTTP requests with child processes spawned by web or application services, unexpected outbound DNS/HTTP callbacks, creation of files in temporary or web-accessible paths, and authentication or privilege changes shortly after the request. Because exploitation is reported in the wild and the issue is in CISA KEV, perform retrospective hunting from at least the publication date, 2026-01-21, through the present, with special attention to exposed systems and any activity before patch deployment.

• /var/log/active/tomcat/logs/localhost_access_log
• /var/log/active/tomcat/logs/catalina.out
• /var/log/active/platform/log
• %3Bwhoami
• %3Bid
• %3Buname
• %3Bcurl
• %3Bwget
• %7Cwhoami
• %7Cid
• %7Ccurl
• %7Cwget
• $%28id%29
• $%28whoami%29
• `id`
• `whoami`
• ; /bin/sh
• ; /bin/bash
• | /bin/sh
• | /bin/bash
• curl http://
• wget http://
• nslookup
• /tmp/
• /var/tmp/
• /dev/shm/
• python -c
• perl -e
• bash -c
• sh -c

What your security team should do

• Immediately inventory all Cisco Unified Communications Manager, Unified CM IM & Presence, Unity Connection, Unified CM SME, and Webex Calling Dedicated Instance deployments, including non-production and disaster-recovery systems.
• Prioritize patching because the vulnerability is unauthenticated, remotely exploitable, listed in CISA KEV, and reported as actively exploited in the wild.
• If patching cannot be completed immediately, remove internet exposure and restrict management-interface access to trusted administrative networks through firewalls, VPNs, or bastions.
• Review the CISA KEV deadline of 2026-02-11 and escalate any remaining affected systems as overdue remediation exceptions.
• Hunt for exploitation attempts in HTTP access logs, application logs, reverse-proxy logs, firewall logs, EDR telemetry, and DNS/proxy records around the management interface.
• Look for evidence of command execution by web or application service accounts, unexpected outbound connections, new files in web-accessible or temporary directories, and privilege-escalation activity.
• Rotate credentials and secrets that may be stored on or accessible from affected communications systems if compromise is suspected.
• After patching, perform a post-remediation exposure review to ensure management interfaces remain segmented and monitored.