Cisco Unified CM SSRF flaw exploited to drop webshells (CVE-2026-20230)

On 24 June 2026, security researchers warned that attackers had begun actively exploiting CVE-2026-20230, a critical server-side request forgery (SSRF) vulnerability in Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME). The flaw — caused by improper input validation of specific HTTP requests — lets an unauthenticated, remote attacker coerce the server into making crafted requests, and is being abused to write files to the underlying operating system as a stepping stone toward full compromise.

What happened

The vulnerability is reachable through Cisco's WebDialer service, a click-to-dial component. WebDialer is disabled by default, but it is routinely enabled in production enterprise telephony deployments, leaving a large installed base exposed. Cisco rated the issue Critical despite a CVSS v3.1 base score of 8.6.

After public exploit code surfaced, exploitation escalated quickly. Researchers first observed weekend reconnaissance from a single source IP sending crafted file:// payloads to write files on affected devices, before activity shifted to automated, Tor-routed sweeps dropping multi-stage JSP webshells through the WebDialer SSRF chain. The same file-write primitive can be leveraged to plant artifacts that ultimately allow escalation to root on the host.

Impact

Unified CM is the call-control core of many enterprise and government telephony estates, and a webshell on that server hands an attacker a persistent foothold inside the voice infrastructure and the network around it. Observers cautioned that patching alone may not evict an intruder who has already dropped a webshell, so exposed organisations need to hunt for implants in addition to upgrading.

Remediation

Cisco's fixes cover all affected 14.x releases prior to 14SU6 and all 15.x releases prior to 15SU5, with an interim Cisco Options Package (COP) patch available for 15.x deployments that cannot immediately move to a full service update. Disabling WebDialer where it is not required removes the exploitation path until patches can be applied.