Cisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to Root
Summary: Threat actors have begun exploiting CVE-2026-20230, a CVSS 8.6 improper input validation flaw in Cisco Unified CM and Unified CM SME that lets an unauthenticated remote attacker send crafted HTTP requests to write files to the underlying operating system and later elevate to root. Defused Cyber reported exploitation from a single source using an unvetted PoC with file:// file-write payloads landing on its decoys, and exploitation requires the WebDialer service, which is disabled by default; the flaw is fixed in versions 14SU6 and 15SU5.
Bottom line: CISA added CVE-2026-20230 to its KEV catalog on June 25, 2026, with a June 28, 2026 deadline for FCEB agencies, and Cisco confirmed active exploitation on July 1, 2026 - so any Unified CM deployment with WebDialer turned on is a live target, not a theoretical one.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-20230CVE-2026-20262
- Related
- CVE-2026-20230: Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability Known Exploited Vulnerabilities · Jun 25, 2026CVE-2026-20262: Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability Known Exploited Vulnerabilities · Jun 15, 2026