Cisco Unified CM SSRF flaw exploited in wild attacks

Cisco has confirmed that a critical security flaw in its Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME) is being exploited in the wild. The vulnerability, tracked as CVE-2026-20230, enables unauthenticated attackers to conduct server-side request forgery (SSRF) attacks, potentially leading to root-level access on affected devices. Cisco issued patches for the flaw on June 3, but recent reports indicate that exploitation attempts have already begun, primarily for reconnaissance purposes.

The vulnerability stems from improper input validation in the WebDialer component, which processes user-supplied URLs. Attackers can exploit this flaw by sending crafted HTTP requests containing file:// URIs, forcing the system to write arbitrary files to the underlying operating system. Successful exploitation could allow attackers to escalate privileges to root, though current activity appears focused on identifying vulnerable systems rather than deploying malicious payloads.

How the exploit works

Researchers at SSD Secure, who initially disclosed the vulnerability to Cisco, published a technical analysis detailing the attack chain. The flaw requires attackers to first obtain the target system’s hostname, which can be retrieved through reconnaissance. Once obtained, attackers can craft requests to write files to specific paths, such as /tmp/cve-2026-20230-test.txt, as observed in recent attacks. While the current exploitation appears limited to testing for vulnerable devices, the disclosure of technical details increases the risk of broader attacks.

Threat intelligence firm Defused reported observing exploitation over the weekend, originating from a single IP address. The firm noted that the flaw had not been previously recorded in exploitation databases, such as CISA’s Known Exploited Vulnerabilities (KEV) catalog, at the time of detection. Cisco has not yet responded to requests for comment on the scope of the attacks or indicators of compromise (IOCs) for defenders.

Impact and mitigation

The vulnerability poses a significant risk to organizations using Cisco Unified CM or Unified CM SME, particularly those with internet-exposed instances. While current attacks appear to be limited to reconnaissance, the potential for root-level access makes this a critical issue for security teams. Cisco has urged customers to apply the available patches immediately, as there are no workarounds for the flaw.

What to watch

The disclosure of the proof-of-concept exploit and the observed reconnaissance activity suggest that broader exploitation is likely. Organizations should monitor for updates from Cisco regarding IOCs or additional mitigation guidance. Security researchers may also release detection rules for SIEM and EDR platforms to help defenders identify exploitation attempts.