[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5_LQ7-KLhgFxo_R_hWgnxrgHVgKaWISuEaHJMfjZDBM":3},{"article":4,"iocs":44,"watch_terms":49,"solutions":50,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"f56db750-ef27-41e5-8b05-0130d39000e9","Cisco finally confirms attackers exploiting Unified CM flaw","cisco-finally-confirms-attackers-exploiting-unified-cm-flaw-d5a8ae","Cisco confirmed that attackers are now exploiting a Unified Communications Manager (Unified CM) vulnerability patched in early June. [...]","Cisco has confirmed that attackers are actively exploiting a previously patched vulnerability (CVE-2026-20230) in its Unified Communications Manager (Unified CM) software. The SSRF flaw allows unauthenticated attackers to remotely create files on targeted devices. Cisco initially patched the vulnerability in early June and was aware of public exploit code but had no evidence of active exploitation, which later emerged.","Cisco confirms active exploitation of Unified CM vulnerability CVE-2026-20230.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcisco-finally-confirms-attackers-exploiting-unified-cm-flaw\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F07\u002F02\u002FCisco.jpg","2026-07-02T11:35:25+00:00","2026-07-02T12:00:20.158884+00:00",8,[17,20,23],{"name":18,"type":19},"Unified Communications Manager","product",{"name":21,"type":22},"Cisco","vendor",{"name":24,"type":25},"SSRF","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":26,"icon":28,"name":29,"slug":30},null,"Vulnerabilities","vulnerabilities",[32,37,39],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":38},{"id":26,"icon":28,"name":29,"slug":30},{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45],{"type":46,"value":47,"context":48},"cve","CVE-2026-20230","Cisco Unified Communications Manager (Unified CM) SSRF vulnerability.",[21,18],{"controls":51,"vendors":139},[52,81,110],{"slug":53,"name":54,"problem":55,"products":56},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":82,"name":83,"problem":84,"products":85},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"watchtowr","watchTowr","\u002Fvendor-logos\u002Fwatchtowr.png","watchtowr-platform","watchTowr Platform","https:\u002F\u002Fwatchtowr.com\u002Fplatform\u002F","Continuous discovery of internet-facing assets, with automated testing for exploitable vulnerabilities.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"censys","Censys","\u002Fvendor-logos\u002Fcensys.png","censys-external-exposure-management","Censys External Exposure Management","https:\u002F\u002Fcensys.com\u002Fsolutions\u002Fexternal-exposure-management","External attack surface discovery based on continuous internet-wide scanning.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"detectify","Detectify","\u002Fvendor-logos\u002Fdetectify.png","surface-monitoring","Detectify Surface Monitoring","https:\u002F\u002Fdetectify.com\u002Fproduct\u002Fsurface-monitoring","Continuous discovery and testing of internet-facing subdomains and services.",{"slug":111,"name":112,"problem":113,"products":114},"patch-management","Automated patch management","Known holes get closed in days, not months.",[115,123,131],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",[140],{"slug":141,"name":21,"logo_path":142,"roles":143},"cisco","\u002Fvendor-logos\u002Fcisco.png",[144],"affected",{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":160},"cisco-unified-cm-ssrf-flaw-actively-exploited-after-delayed-patch-response","Cisco Unified CM SSRF Flaw Actively Exploited After Delayed Patch Response","Cisco confirmed active exploitation of CVE-2026-20230, a Server-Side Request Forgery (SSRF) vulnerability in Unified Communications Manager that allows unauthenticated attackers to remotely create files on affected devices. The vulnerability was patched in early June, yet active exploitation only emerged after public exploit code became available — highlighting the dangerous window between patch release and enterprise deployment. This case underscores how the existence of public exploit code dramatically shortens the time organizations have to patch before attackers weaponize the vulnerability. Critical communication infrastructure like Unified CM is a high-value target, and delays in applying available patches directly translate to increased organizational risk.",[150,151,152,153,154,155,156,157,158,159],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST RA-5: Vulnerability Monitoring and Scanning","NIST SC-7: Boundary Protection","NIST SI-7: Software, Firmware, and Information Integrity","ITIL: Change and Release Management (Emergency Change procedures)","ISO\u002FIEC 27001 A.12.6.1: Management of Technical Vulnerabilities",{}]