CISA KEV · Known exploitedHigh

CVE-2026-20230

Cisco Cisco Unified Communications Manager, unified communications manager

A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elev...

CVSS: 8.6
EPSS: 83.2%
CISA KEV: Listed
Published: 2026.06.04

PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV

Exploit probability83.2%

Technical severityCVSS 8.6

Vulnerability overview

Affected product and versions

Product: Cisco Cisco Unified Communications Manager, unified communications manager
Affected versions: >= 14, >= 14SU1, >= 14SU2, >= 14SU3, >= 15, >= 15SU1, >= 14SU4, >= 14SU4a, >= 15SU1a, >= 15SU2, >= 15.0.1.13010-1, >= 15.0.1.13011-1, >= 15.0.1.13012-1, >= 15.0.1.13013-1, >= 15.0.1.13014-1, >= 15.0.1.13015-1, >= 15.0.1.13016-1, >= 15.0.1.13017-1, >= 15SU3a, >= 14SU5
Fixed versions: 14su6

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Due date: 2026.06.28

1
Identify
Confirm that Cisco Cisco Unified Communications Manager, unified communications manager and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
CWE: CWE-918
KEV added: 2026.06.25
Ransomware use: 미확인