Back Mallory.Ai Cisco Unified CM Flaw Faces Active Exploitation After PoC Release
Attackers are actively exploiting CVE-2026-20230 , a critical flaw in Cisco Unified Communications Manager ( Unified CM ) and Unified CM Session Management Edition ( Unified CM SME ), shortly after technical details and proof-of-concept code became public. Cisco said the bug stems from improper input validation in certain HTTP requests and can let an unauthenticated attacker perform SSRF , write arbitrary files to the underlying operating system, and potentially escalate privileges to root ; researchers also described a path to unauthenticated remote code execution. Exploitation requires the WebDialer service to be enabled, although Cisco notes it is disabled by default.
Exploit intelligence firm Defused reported seeing attacks from a single source using an unvetted PoC, with file:// file-write payloads observed against decoy systems over the weekend. Cisco patched the issue in Unified CM 14SU6 and 15SU5 , while SSD Secure Disclosure, which reported the vulnerability, published additional technical details showing how attackers could recover a target's true hostname and progress toward code execution. Cisco has advised customers to apply the fixes and, if patching cannot be done immediately, disable WebDialer to reduce exposure on widely deployed enterprise voice platforms.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Over the weekend, Defused reported seeing active exploitation from a single source using an unvetted proof-of-concept. Its decoy systems were hit with file-write payloads targeting the flaw.
Shortly after Cisco's patch, SSD Secure Disclosure published technical details and proof-of-concept code for the vulnerability. The material showed the issue could be leveraged for unauthenticated remote code execution, including obtaining the target's true hostname and enabling a path toward code execution.
On 2026-06-03, Cisco disclosed and patched CVE-2026-20230, a critical vulnerability in Unified Communications Manager and Unified CM SME. Cisco said the flaw could allow unauthenticated SSRF, arbitrary file writes to the underlying operating system, and potential privilege escalation to root when WebDialer is enabled.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the morning.
Ask questions this story and take action on the answers.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
