Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public
Summary: Cisco patched CVE-2026-20230, a server-side request forgery in Unified Communications Manager and its Session Management Edition that lets an unauthenticated network attacker write arbitrary files to the underlying OS and then escalate to root. Cisco's PSIRT says it has not seen the flaw exploited yet, but proof-of-concept code is already public; the CVSS base score is 8.6, while Cisco rated the advisory Critical because of the root escalation, and the flaw only works when the WebDialer service is running, which ships off by default.
What's compelling: The fix for the 15 train is not due until September 2026, so until then those deployments are on an interim COP patch or must turn WebDialer off, with working exploit code already public.