Cisco Unified Communications Manager: Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability
› Cisco Unified Communications Manager
Get an email when a new major security incident drops. No spam, unsubscribe any time.
- started
- Jun 25, 2026
- closed
- Jun 25, 2026
- CVEs
- 1
- sources
- 3
## summary
Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) Vulnerability that could allow an unauthenticated, remote attacker to write files to the underlying operating system that could be used later to elevate to root. Added to CISA KEV on 2026-06-25.
severity: Actively exploited (CISA KEV)
## cve ids[1]
## affected
- See vendor advisory / CISA notes (versions not always listed in KEV feed)
## fixed in
- See vendor advisory linked in sources
## timeline[1]
CISA added CVE-2026-20230 to the KEV catalog (due 2026-06-28).
## advisories[2]
## news & write-ups[1]
## notes & caveats
Derived from CISA KEV JSON feed catalogVersion 2026.10.21. Exact affected/fixed version strings are not always in the KEV record — verify against the vendor advisory URL. startedAt uses dateAdded (exploitation may have begun earlier).
