CVE-2026-20230

What it actually does

CVE-2026-20230 is an unauthenticated server-side request forgery vulnerability in Cisco Unified Communications Manager and Unified CM Session Management Edition when the WebDialer service is enabled. Because specific HTTP request inputs are not properly validated, a remote attacker can cause the affected appliance to issue unintended server-side requests and write files to the underlying operating system. Cisco rates the issue as Critical because the file-write primitive can be used as part of a follow-on chain to elevate privileges to root, even though the CVSS score is 8.6.

Why it matters to the business

Successful exploitation can compromise a core voice and collaboration platform, potentially allowing attackers to alter system files, establish persistence, disrupt call-management services, and use the communications server as a foothold for deeper network access. The risk is urgent because exploitation is reported as active in the wild, the EPSS probability is high, the vulnerability is in CISA KEV, and the CISA remediation due date of 2026-06-28 has passed. Organizations that expose Unified CM management or WebDialer interfaces to untrusted networks face elevated risk.

How an attack unfolds

An attacker first identifies a Cisco Unified Communications Manager or Unified CM SME system with the WebDialer service enabled and reachable over HTTP or HTTPS. The attacker sends a crafted unauthenticated HTTP request to the WebDialer-related interface that abuses improper input validation to trigger server-side request forgery behavior. Through the vulnerable request handling path, the attacker causes the appliance to write attacker-controlled or attacker-influenced files to the operating system. Those files can then be used in a subsequent privilege-escalation step to gain root-level control. After gaining higher privileges, an attacker may modify system configuration, deploy persistence, collect sensitive configuration data, pivot to adjacent systems, or disrupt voice services.

How to fix it

Apply the Cisco-provided fixed software release or engineering special for the affected Unified CM or Unified CM SME train as soon as available from Cisco. Because no fixed versions were provided in the input, administrators should consult the current Cisco security advisory for the exact recommended release for their deployment train. If immediate patching is not possible, disable the WebDialer service wherever it is not operationally required, because Cisco states WebDialer is required for exploitation and is disabled by default. Restrict access to Unified CM web interfaces to trusted administrative networks, block direct internet exposure, enforce network segmentation around collaboration infrastructure, and monitor for suspicious WebDialer requests or unexpected file modifications on the appliance. Treat systems with WebDialer enabled and exposed prior to remediation as potentially compromised and review them before returning them to normal trust.

How to confirm the fix worked

Validate remediation by confirming that the Cisco Unified CM or Unified CM SME version matches a Cisco-designated fixed release for the installed train. Confirm the WebDialer service is disabled if not required, or restricted to trusted networks if required. Test from an untrusted network segment to ensure WebDialer-related URLs and management interfaces are not reachable. Review Cisco service status, web service configuration, and administrative settings to verify WebDialer exposure. Confirm that HTTP access logs no longer show unauthenticated access attempts to WebDialer endpoints from untrusted sources. If a scanner or vendor-provided verification check is available, run it only from authorized security infrastructure and validate results against the installed software version and service state.

Typical attack path

1. Scan for internet-facing or internally reachable Cisco Unified Communications Manager or Unified CM SME systems.
2. Confirm that the WebDialer service is enabled and accessible.
3. Send crafted unauthenticated HTTP requests to the WebDialer-related endpoint to trigger the SSRF condition.
4. Use the SSRF/file-write behavior to place files on the underlying operating system.
5. Leverage the written files in a follow-on local privilege-escalation chain to obtain root privileges.
6. Establish persistence, access sensitive configuration, alter system behavior, or use the compromised communications server for lateral movement.

How to detect it

To assess prior exploitation, review Cisco Unified CM web access logs, Tomcat logs, application logs, reverse proxy logs, firewall logs, IDS/IPS events, and EDR or file-integrity telemetry if available. Focus on requests to WebDialer-related paths from unknown external hosts, unauthenticated clients, unusual user agents, high request volumes, malformed parameters, URL-encoded payloads, loopback or internal-network targets embedded in request parameters, and requests followed by unexpected file creation or modification on the appliance. Correlate suspicious WebDialer access with operating-system artifacts such as new files in web/application directories, changed permissions, unexpected scheduled tasks or startup items, anomalous root-level commands, unexplained service restarts, and outbound connections from the Unified CM server to unfamiliar destinations. Because this vulnerability is known to be exploited in the wild, systems that had WebDialer enabled and reachable before remediation should be treated as candidates for compromise even if exploitation indicators are sparse.

• /webdialer/
• /Webdialer
• WebDialer
• webdialer
• CiscoWebDialer
• localhost_access_log
• /var/log/active/tomcat/logs/
• /var/log/active/platform/log/
• GET /webdialer/
• POST /webdialer/
• GET /webdialer/Webdialer
• POST /webdialer/Webdialer

What your security team should do

• Treat this as an urgent remediation item because it is in CISA KEV, has active exploitation reported, has a high EPSS score, and the KEV due date has passed.
• Inventory all Cisco Unified Communications Manager and Unified CM SME systems and identify where WebDialer is enabled.
• Patch to the Cisco-designated fixed release for each affected deployment train; if patching cannot be completed immediately, disable WebDialer unless it is business-critical.
• Remove internet exposure and restrict Unified CM web interfaces to trusted administrative and application networks only.
• Review web access logs for historical WebDialer requests, especially unauthenticated requests from unfamiliar IP addresses or unusual user agents.
• Perform file-integrity and configuration review on exposed systems, prioritizing systems with WebDialer enabled before patching.
• Hunt for signs of privilege escalation, unexpected root-level activity, new or modified files in application and web directories, and suspicious outbound connections from Unified CM servers.
• If exploitation is suspected, isolate the appliance, preserve logs, collect forensic artifacts, rotate relevant credentials, and rebuild or restore from trusted media following Cisco guidance.