~/f4n6 $ grep -r "Hackers Exploiting Cisco Unified CM Vulnerability" ./investigations/ --include="*.md"

Hackers Exploiting Cisco Unified CM Vulnerability

Jeff Davies 24 Jun 2026 6 min read

1. Executive summary

Threat actors are actively exploiting CVE-2026-20230, a high-severity server-side request forgery (SSRF) flaw in Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME). The vulnerability allows an unauthenticated, remote attacker to conduct SSRF attacks, write arbitrary files to the underlying operating system, and escalate privileges to root. Exploitation requires the WebDialer service to be enabled, which is disabled by default. Cisco released patches on 3 June 2026; a public PoC has been available since disclosure, and exploit-intelligence firm Defused reports observing in-the-wild exploitation from a single source using an unvetted PoC with file:// file-write payloads. CVE-2026-20230 is rated CVSS 8.6 (HIGH), is not yet listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and carries an EPSS exploitation probability of 20%. EMEA financial services firms running on-premises Cisco UC infrastructure — particularly contact-centre or WebDialer-enabled deployments — should treat this as a P1 patching priority.

2. Regulatory framing

Article Trigger (fact in this item) Practical impact
DORA Art. 17 Active in-the-wild exploitation of a third-party ICT component (Cisco Unified CM) Activate the ICT-related incident management process; document detection, triage and response steps for any suspected exploitation.
DORA Art. 18 Confirmed exploitation activity against a critical communications platform Classify any observed exploitation under the ICT-related incident taxonomy; record as a cyber-threat event regardless of whether it crosses the "major" threshold.
DORA Art. 19 Potential for root-level compromise on a system supporting critical voice/UC services If exploitation is confirmed and meets the major-incident criteria, report to the competent authority within the prescribed timelines.
DORA Art. 28 Cisco operates as an ICT third-party provider supplying Unified CM/SME Apply third-party risk principles: confirm patch status, validate vendor advisories, and ensure contractual notification flows with Cisco are honoured.
DORA Art. 29 Unified CM is a flagship on-premises call-control platform; many firms have concentration risk on Cisco UC Re-assess concentration risk where WebDialer or other UC services are enabled; document compensating controls.
DORA Art. 30 Vendor (Cisco) has issued security updates and a security advisory Verify contractual entitlement to receive and act on Cisco security advisories; ensure SLAs permit timely patching.
NIS2 Art. 21(2)(d) Supply-chain component (Cisco Unified CM) under active exploitation Apply supply-chain security measures: patch validation, integrity checks, and supplier risk re-assessment.
NIS2 Art. 23 Active exploitation of an ICT system within scope If the affected entity falls in scope and exploitation is confirmed, the incident-reporting obligations apply.
UK NIS 2018 Cisco Unified CM may underpin OES/RDSP voice services OES/RDSP duties apply where UC infrastructure supports essential services; ensure incident handling aligns with the UK NIS regime.

3. Technical analysis & attack chain

Vulnerability mechanism (CVE-2026-20230, CWE-918 SSRF)

  • Improper input validation on specific HTTP requests processed by Cisco Unified CM / Unified CM SME.
  • Unauthenticated, remote attacker triggers the flaw via crafted HTTP requests.
  • Successful exploitation yields three chained capabilities: SSRF, arbitrary file write to the underlying OS, and privilege escalation to root.
  • Pre-condition: the WebDialer service must be enabled (disabled by default in a fresh install).

Attack chain (confirmed steps)

  1. Reconnaissance / target selection. Attacker identifies a Cisco Unified CM or Unified CM SME deployment with the WebDialer service enabled. Public PoC code (published by SSD Secure Disclosure) and an unvetted PoC circulating in the wild lower the technical bar.
  2. Initial access — SSRF. Attacker sends crafted HTTP requests to the Unified CM WebDialer interface. The server-side request forgery causes the appliance to issue outbound requests on the attacker's behalf, including file:// URIs.
  3. File write. Using the SSRF primitive, the attacker writes arbitrary files to the underlying operating system via file:// file-write payloads. Defused reports observing "genuinely-formatted file:// file-write payloads landing on our decoys."
  4. Privilege escalation to root. The arbitrary file write is leveraged to escalate privileges to root on the Unified CM appliance.
  5. Post-exploitation. With root on the UC platform, the attacker gains full control of call control, session management, and any integrated voice/video services.

Component / version scope

  • Cisco Unified Communications Manager (Unified CM) — all deployments with WebDialer enabled and unpatched.
  • Cisco Unified CM Session Management Edition (Unified CM SME) — same exposure profile.
  • Patches were released by Cisco on 3 June 2026; consult the Cisco security advisory for the exact fixed versions.

Unconfirmed / single-sourced claims

  • Defused attributes the activity to "a single source using an unvetted PoC." No threat-actor name has been published; treat attribution as unconfirmed.
  • Cisco has not yet confirmed exploitation in its own advisory at the time of writing.
  • CVE-2026-20230 is not yet listed in CISA KEV, despite observed in-the-wild exploitation.
  • A separate, unpatched Cisco Catalyst SD-WAN Manager zero-day (CVE-2026-20245) is also under active exploitation enabling root privilege escalation; this is a distinct issue and does not affect Unified CM directly.
  • CVE-2026-20045 was the first Cisco Unified CM vulnerability exploited in 2026 prior to this one.

4. Mitigation & containment

P1 — within 24 hours

  • Patch. Apply the Cisco security updates released on 3 June 2026 to all Unified CM and Unified CM SME instances. Pin to the fixed versions listed in the Cisco advisory.
  • Disable WebDialer if not required. If business operations permit, disable the WebDialer service on all Unified CM nodes. This removes the exploitation pre-condition entirely.
  • Network containment. Restrict Unified CM management interfaces (HTTPS/SSH) to trusted administrative networks; ensure the WebDialer interface is not exposed to the public internet.
  • Hunt. Search Unified CM logs and any integrated SIEM for HTTP requests containing file:// URIs or anomalous outbound requests originating from the UC appliance.

P2 — within 72 hours

  • Validate integrity. Inspect the Unified CM filesystem for unauthorised files, modified binaries, or new cron/systemd units introduced since the patch window opened (3 June 2026 onward).
  • Credential rotation. Rotate administrative and service-account credentials on the UC platform and any integrated systems (LDAP/AD, SIP trunks, CTI integrations).
  • Configuration review. Audit WebDialer configuration, ACLs, and any custom scripts or integrations that touch the WebDialer service.

P3 — within 7 days

  • Tabletop / resilience test. Validate that voice, contact-centre, and emergency-services workflows remain operational with WebDialer disabled or under hardened configuration.
  • Vendor engagement. Confirm with Cisco that contractual notification flows (per DORA Art. 30) are honoured and that patch deployment evidence is retained.
  • Concentration-risk review. Re-assess UC concentration risk per DORA Art. 29 where WebDialer or other UC services are business-critical.

5. Indicators of compromise

Type Value Confidence Source
pattern HTTP requests containing file:// URIs against Unified CM WebDialer interface Medium Defused (via SecurityWeek)

No specific IP addresses, file hashes, domains, or filenames were disclosed in the source material.

pattern  file:// file-write payloads targeting Cisco Unified CM WebDialer

6. Detection

Sigma rule — HTTP requests with file:// scheme to Unified CM

title: Cisco Unified CM SSRF File-Write Attempt
id: AT-2026-06-24-153-001
status: experimental
description: Detects HTTP requests containing file:// URIs targeting Cisco Unified CM WebDialer (CVE-2026-20230)
author: Adverse Trace
date: 2026-06-24
references:

  - https://www.securityweek.com/hackers-exploiting-cisco-unified-cm-vulnerability/
logsource:
  product: cisco_unified_cm
  category: webserver
detection:
  selection_uri:
    cs-uri-query|contains: 'file://'
  selection_path:
    cs-uri-stem|contains:

      - 'webdialer'
      - 'WebDialer'
      - '/webdialer/'
  condition: selection_uri and selection_path
fields:

  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs-user-agent
falsepositives:

  - Legitimate internal file-fetch operations (rare; review)
level: high

YARA rule — file-write payload artefacts

rule AT_CiscoUnifiedCM_FileWritePayload_2026
{
    meta:
        author = "Adverse Trace"
        date = "2026-06-24"
        description = "Detects file:// file-write payloads associated with CVE-2026-20230 exploitation against Cisco Unified CM"
        reference = "https://www.securityweek.com/hackers-exploiting-cisco-unified-cm-vulnerability/"
        tlp = "AMBER"

    strings:
        $file_scheme = "file://"
        $webdialer_a = "WebDialer"
        $webdialer_b = "webdialer"
        $cve_ref = "CVE-2026-20230"

    condition:
        $file_scheme and any of ($webdialer_a, $webdialer_b) or
        $file_scheme and $cve_ref
}

CVE assessment

1 referenced CVE

CVE CVSS Exploited EPSS Summary
CVE-2026-20230 8.6 High — 20% A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Managemen…

7. Sources

  • SecurityWeek — Hackers Exploiting Cisco Unified CM Vulnerability (24 June 2026): https://www.securityweek.com/hackers-exploiting-cisco-unified-cm-vulnerability/
  • SecurityWeek — Cisco Warns of Available PoC for Critical Unified CM Vulnerability: https://www.securityweek.com/cisco-warns-of-available-poc-for-critical-unified-cm-vulnerability/
  • The Hacker News — Cisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to Root: https://thehackernews.com/2026/06/cisco-unified-cm-flaw-exploited-after.html
  • BleepingComputer — Cisco warns of critical Unified CM flaw with PoC exploit code: https://www.bleepingcomputer.com/news/security/cisco-warns-of-critical-unified-cm-flaw-with-poc-exploit-code/
  • BleepingComputer — Cisco Unified CM flaw CVE-2026-20230 now exploited in attacks: https://www.bleepingcomputer.com/news/security/cisco-unified-cm-sme-flaw-cve-2026-20230-now-exploited-in-attacks/

8. Adverse Trace position

Severity: HIGH. CVE-2026-20230 is unauthenticated, remotely exploitable, and yields root on a flagship enterprise communications platform. The combination of a public PoC, observed in-the-wild exploitation, and a high CVSS / 20% EPSS score places this firmly in P1 territory for any EMEA financial services firm running Unified CM with WebDialer enabled. Client impact: firms with contact-centre, trading-floor voice, or emergency-services integrations on Cisco UC should treat any unpatched Unified CM instance as exposed. Next steps: Adverse Trace will (1) monitor for CISA KEV listing and update this advisory accordingly, (2) track Cisco's formal confirmation of exploitation, and (3) provide tailored detection content and incident-response support to affected clients on request.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.

Post this to LinkedIn
Formatting is converted automatically — headings, bullets, a link back & hashtags. Paste straight in.
J
Jeff Davies