High severity vulnerability in Cisco Unified Communications Manager with exploit PoC ...

Ccb.Belgium.Be • June 5, 2026

Vendor Advisory -

This vulnerability allows an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device.

A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root.

To exploit this vulnerability, the WebDialer service must be enabled. WebDialer is disabled by default.

The vendor warns that they are aware of proof-of-concept exploit code for this vulnerability.

This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device.

Patch The Centre for Cybersecurity Belgium strongly recommends installing updates for vulnerable instances with the highest priority after thorough testing.

More information on the vendor’s website:

Monitor/Detect The CCB recommends organizations upscale monitoring and detection capabilities to identify any related suspicious activity and ensure a swift response in case of an intrusion.

In case of an intrusion, you can report an incident via .

While patching appliances or software to the newest version may protect against future exploitation, it does not remediate historic compromise.

NIST NVD -

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SSRF Vulnerability in Cisco Unified CM Exposes Enterprises to Root Access Cisco disclosed a critical server-side request forgery (SSRF) vulnerability in its Unified Communications Manager (CVE-2026-20230) on June 3, 2026. This flaw allows attackers with network access to write arbitrary files to the operating system, potentially escalating privileges to root. A proof-of-concept exploit code was released shortly after the disclosure, increasing the urgency for affected organizations. The vulnerability impacts systems where the WebDialer service is enabled, which is often the case in enterprise environments. Cisco has assigned a Critical Security Impact Rating to this vulnerability, despite a CVSS score of 8.6. Administrators are advised to check the status of the WebDialer service and apply security updates promptly. Currently, there is no evidence of active exploitation, but the availability of PoC code raises concerns about potential attacks. Organizations are encouraged to disable the WebDialer service until patches are applied. 8 sources 72

Extracted Entities

High severity vulnerability in Cisco Unified Communications Manager with exploit PoC ...

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

Platforms (1)