Cisco Unified Communications Manager CVE-2026-20230: actively exploited vulnerability added to CISA KEV

Confirmed

Discovered Jun 25, 2026

CISA added CVE-2026-20230 affecting Cisco Unified Communications Manager to the Known Exploited Vulnerabilities catalog on 2026-06-25. This post scopes exposure, fixed-version evidence, and IR handling without treating advisory sites as IOCs.

Affected Packages

Observables

Sources

Defender Action Panel

Triage this incident quickly

Check whether your environment installed affected software, copy the top IOCs, run the tested hunting script when available, then review remediation guidance.

Am I affected?: cisco-unified-communications-manager
Immediate action: Audit locks, CI runners, developer workstations, and credential exposure.
Hunting: Has hunting script

Copy IOCs Run hunting script View sources Jump to remediation

Unified Communications Manager
Cisco
CVE-2026-20230

Analysis

Executive Summary

CISA added CVE-2026-20230 for Cisco Unified Communications Manager to the Known Exploited Vulnerabilities catalog on 2026-06-25, which is the active-exploitation gate for this Halting Problems entry [1]. NVD describes the issue as: A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device.

This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root. Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root. Note: To exploit this vulnerability, the WebDialer service must be enabled. WebDialer is disabled by default. [2].

This entry is intentionally evidence-conservative. The public sources reviewed for this automated refresh provide active-exploitation status, product identity, and vulnerability metadata, but they do not publish attacker-controlled infrastructure, file hashes, victim counts, or a campaign name. Source and advisory URLs are therefore kept as source selectors rather than IOC values.

Key Facts

CVE: CVE-2026-20230

Vendor: Cisco

Product: Unified Communications Manager

KEV Added: 2026-06-25

KEV Due Date: 2026-06-28

Affected / Fixed Version Selectors:

cisco-unified-communications-manager unknown_after_direct_source_review

CVSS: 8.6 HIGH

Evidence Assessment

Analysis table
Claim	Status	Evidence
CISA lists CVE-2026-20230 as exploited in the wild for Cisco Unified Communications Manager.	confirmed	CISA KEV entry for CVE-2026-20230 names `Cisco` and `Unified Communications Manager` and records date added `2026-06-25` [1].
NVD has a CVE record describing the vulnerable product behavior.	confirmed	NVD record for CVE-2026-20230 includes the description quoted above and version metadata where available [2].
Public sources identify attacker infrastructure, hashes, or campaign attribution.	not_observed	CISA KEV, NVD, and linked references reviewed during this run do not publish those IOC classes.

Impact Determination

Treat internet-exposed or identity-integrated Unified Communications Manager systems as high-priority until version and mitigation evidence are captured. Affected systems require product log review, host-level timeline preservation, and a post-fix scan. If exploitation succeeded, defenders should decide whether sessions, API keys, service credentials, or product-managed secrets could have been accessed or abused from the compromised host.

Detection and Hunting

The reviewed hunt manifest ships with scripts/scope_cisco-unified-communications-manager-cve-2026-20230-kev.py. It scans asset inventories and exported logs for CVE-2026-20230, Cisco, Unified Communications Manager, and affected-version selectors. Use it against CMDB exports, scanner exports, EDR file/log bundles, web server logs, and product-specific logs collected in a forensics-safe workspace.

Positive findings are scope signals, not proof of compromise. Escalate to product-specific IR by preserving UTC timelines, snapshots or hashes of relevant configs and logs, evidence owner, collection time, and chain-of-custody notes.

Remediation and Recovery Gates

Confirm whether each Unified Communications Manager instance is affected by matching deployed version evidence against vendor/NVD ranges.
Apply the vendor fixed release or documented mitigation, then capture before/after version proof.
Run a post-fix scan and keep the result with the incident record.
Review product logs and host telemetry for exploit success, persistence, new users, changed configuration, suspicious scheduled tasks, web shells, or unexpected outbound access.
Make a credential/session rotation decision based on whether exploitation reached secrets, sessions, SSO/OIDC material, API keys, or product-managed credentials.
Monitor for recurrence after recovery.

Indicators of Compromise

No attacker-controlled domains, URLs, hashes, or IP addresses were published by the sources reviewed for this entry. Machine-readable IOC fields are intentionally empty for those classes.

Open Questions

Which exploitation clusters are using CVE-2026-20230 in the wild?
Are there reliable product-specific log signatures beyond version and exposure scoping?
Did vendor or researcher sources publish additional affected/fixed-version detail after this automated refresh?

Sources

[1] https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json opens in a new tab [2] https://nvd.nist.gov/vuln/detail/CVE-2026-20230 opens in a new tab [3] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20230 opens in a new tab [4] https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-cucm-ssrf-cXPnHcW.html opens in a new tab

Timeline

Timeline
Date	Event	Description	Source

Invalid Date	Disclosure	Disclosure recorded for Cisco Unified Communications Manager CVE-2026-20230 actively exploited vulnerability.	cisa.gov
Jun 25, 2026	First seen	First seen recorded for Cisco Unified Communications Manager CVE-2026-20230 actively exploited vulnerability.	cisa.gov
Invalid Date	Patch or fix	Patch or fix recorded for Cisco Unified Communications Manager CVE-2026-20230 actively exploited vulnerability.	cisa.gov
Jun 25, 2026	Cisco Unified Communications Manager CVE-2026-20230: actively exploited vulnerability added to CISA KEV	Unknown	cisa.gov
Jun 25, 2026	Discovery	Discovery recorded for Cisco Unified Communications Manager CVE-2026-20230 actively exploited vulnerability.	cisa.gov
Jun 28, 2026	kev due date	kev due date recorded for Cisco Unified Communications Manager CVE-2026-20230 actively exploited vulnerability.	cisa.gov

Affected Software

Affected Software
Package	Ecosystem	Version Range	Status	Confidence	Source
cisco-unified-communications-manager	enterprise-software	unknown_after_direct_source_review	Malicious	90%	cisa.gov; nvd.nist.gov; cisco.com

IOC Clipboard

3 IOCs

commandUnified Communications Manager

commandCisco

commandCVE-2026-20230

Tested Hunting Scripts

Tested Hunting Scripts
Title	Language	Description	Repository	Source
CVE-2026-20230 asset and telemetry scope	Python	Do asset inventories or exported telemetry contain CVE-2026-20230, Cisco, Unified Communications Manager, or affected-version selectors?	scripts/scope_cisco-unified-communications-manager-cve-2026-20230-kev.py opens in a new tab	cisa.gov

Hunt Manifest: CVE-2026-20230 asset and telemetry scope

Title: CVE-2026-20230 asset and telemetry scope
Question: Do asset inventories or exported telemetry contain CVE-2026-20230, Cisco, Unified Communications Manager, or affected-version selectors?
Telemetry Family: Python
Repository: scripts/scope_cisco-unified-communications-manager-cve-2026-20230-kev.py

Show tested hunting scriptscripts/scope_cisco-unified-communications-manager-cve-2026-20230-kev.py

#!/usr/bin/env python3
"""Scope CVE-2026-20230 exposure from asset inventories and exported product logs.

Input: a directory containing CSV, JSON, JSONL, TXT, LOG, YAML, or XML exports.
The script does not contact the network. It looks for the CVE, vendor/product
selectors, and affected-version selectors recorded in the Halting Problems profile.
"""
from __future__ import annotations
import json, os, sys
from pathlib import Path
CVE_ID = 'CVE-2026-20230'
VENDOR = 'Cisco'
PRODUCT = 'Unified Communications Manager'
AFFECTED_VERSION_SELECTORS = [
  "cisco-unified-communications-manager unknown_after_direct_source_review",
]
SOURCE_SELECTORS = [
  "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
  "https://nvd.nist.gov/vuln/detail/CVE-2026-20230",
  "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20230",
  "https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-cucm-ssrf-cXPnHcW.html",
]
DOMAINS = []
HASHES = []
URLS = []
FILES = []
PROCESS_PATTERNS = [PRODUCT, VENDOR, CVE_ID]
NETWORK_PATTERNS = []
INDICATORS = [
  "CVE-2026-20230",
  "Cisco",
  "Unified Communications Manager",
  "cisco-unified-communications-manager unknown_after_direct_source_review",
  "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
  "https://nvd.nist.gov/vuln/detail/CVE-2026-20230",
  "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20230",
  "https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-cucm-ssrf-cXPnHcW.html",
]
OUT = os.environ.get("OUT", "hp-cisco-unified-communications-manager-cve-2026-20230-kev-scope")
TEXT_SUFFIXES = {'.csv','.json','.jsonl','.txt','.log','.yaml','.yml','.xml','.conf','.ini','.md'}
EXCLUDED_DIR_NAMES = {'.git','node_modules','vendor','dist','__pycache__','.venv'}
def read_text(path: Path) -> str:
    try: return path.read_text(encoding='utf-8', errors='ignore')
    except Exception: return ''
def iter_files(root: Path):
    if root.is_file():
        yield root; return
    for q in root.rglob('*'):
        if q.is_file() and not any(part in EXCLUDED_DIR_NAMES for part in q.parts):
            if not q.suffix or q.suffix.lower() in TEXT_SUFFIXES: yield q
def scan(root: Path):
    matches=[]; lowered=[s.lower() for s in INDICATORS if s]
    for path in iter_files(root):
        low=read_text(path).lower(); hits=sorted({INDICATORS[i] for i,s in enumerate(lowered) if s in low})
        if hits: matches.append({'path': str(path), 'hits': hits})
    return matches
def main(argv=None):
    argv=argv or sys.argv[1:]; root=Path(argv[0]) if argv else Path('.')
    matches=scan(root); out_dir=Path(OUT); out_dir.mkdir(parents=True, exist_ok=True)
    report={'cve': CVE_ID, 'vendor': VENDOR, 'product': PRODUCT, 'affected_version_selectors': AFFECTED_VERSION_SELECTORS, 'match_count': len(matches), 'matches': matches}
    (out_dir/'scope_report.json').write_text(json.dumps(report, indent=2), encoding='utf-8')
    print(json.dumps({'cve': CVE_ID, 'match_count': len(matches), 'report': str(out_dir/'scope_report.json')}, indent=2))
    return 2 if matches else 0
if __name__ == '__main__': raise SystemExit(main())

Provenance & Sources

Provenance & Sources
Source	Type	Reliability	Claims	Evidence
cisa.gov	Security Researcher	95%	2	CISA added CVE-2026-20230 affecting Cisco Unified Communications Manager to the Known Exploited Vulnerabilities catalog on 2026-06-25. This post scopes exposure, fixed-version evidence, and IR handling without treating advisory sites as IOCs.
nvd.nist.gov	Security Researcher	95%	1	CISA added CVE-2026-20230 affecting Cisco Unified Communications Manager to the Known Exploited Vulnerabilities catalog on 2026-06-25. This post scopes exposure, fixed-version evidence, and IR handling without treating advisory sites as IOCs.
cisco.com	Security Researcher	95%	1	CISA added CVE-2026-20230 affecting Cisco Unified Communications Manager to the Known Exploited Vulnerabilities catalog on 2026-06-25. This post scopes exposure, fixed-version evidence, and IR handling without treating advisory sites as IOCs.