Cisco finally confirms attackers exploiting Unified CM flaw
Cisco confirms active exploitation of Unified CM vulnerability CVE-2026-20230.
Cisco has confirmed that attackers are actively exploiting a previously patched vulnerability (CVE-2026-20230) in its Unified Communications Manager (Unified CM) software. The SSRF flaw allows unauthenticated attackers to remotely create files on targeted devices. Cisco initially patched the vulnerability in early June and was aware of public exploit code but had no evidence of active exploitation, which later emerged.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Cisco?
Get an email when a new story names Cisco, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonCisco confirmed active exploitation of CVE-2026-20230, a Server-Side Request Forgery (SSRF) vulnerability in Unified Communications Manager that allows unauthenticated attackers to remotely create files on affected devices. The vulnerability was patched in early June, yet active exploitation only emerged after public exploit code became available — highlighting the dangerous window between patch release and enterprise deployment. This case underscores how the existence of public exploit code dramatically shortens the time organizations have to patch before attackers weaponize the vulnerability. Critical communication infrastructure like Unified CM is a high-value target, and delays in applying available patches directly translate to increased organizational risk.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- External attack surface management (EASM)
You find your forgotten internet-facing systems before attackers do.
- Automated patch management
Known holes get closed in days, not months.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-20230