Cisco Unified Communications Manager CVE-2026-20230 flaw with public exploit code, patches released
Every organization running Cisco $CSCO Unified Communications Manager should patch now. A flaw tracked as CVE-2026-20230 lets a crafted web request write arbitrary files onto the system, and proof-of-concept exploit code is already public. Cisco has released fixes. Source: Cisco.
Anyone administering Cisco Unified Communications Manager, the call-control platform behind countless enterprise phone systems, has a patch to apply. Cisco $CSCO has disclosed a vulnerability tracked as CVE-2026-20230 affecting Unified CM and its Session Management Edition. The root cause is a server-side request forgery weakness: the software fails to properly validate certain HTTP requests, so an attacker who sends a crafted request can push the server into writing arbitrary files onto the underlying operating system. That kind of write access is a stepping stone toward deeper compromise of a system that sits at the heart of an organization's voice infrastructure. The urgency comes from timing. Proof-of-concept exploit code is already public, which shortens the window between disclosure and opportunistic attacks against systems left unpatched. Cisco has released version-specific fixes, so administrators need to confirm which build they are running before applying the correct update rather than assuming a single patch covers every deployment. Communications infrastructure is an attractive target because it is widely deployed, often internet-facing, and rarely the first thing security teams check. Source: Cisco, The Hacker News.