PoC Exploit Released for Cisco Unified Communications Manager Security Vulnerability

Gbhackers •Divya • June 4, 2026

A proof-of-concept (PoC) exploit has been released for a critical server-side request forgery (SSRF) vulnerability impacting Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (Unified CM SME), increasing the likelihood of active exploitation in enterprise environments. Cisco Unified Manager Security Vulnerability Tracked as CVE-2026-20230 and detailed in Cisco advisory cisco-sa-cucm-ssrf-cXPnHcW, the […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SSRF Vulnerability in Cisco Unified CM Exposes Enterprises to Root Access Cisco disclosed a critical server-side request forgery (SSRF) vulnerability in its Unified Communications Manager (CVE-2026-20230) on June 3, 2026. This flaw allows attackers with network access to write arbitrary files to the operating system, potentially escalating privileges to root. A proof-of-concept exploit code was released shortly after the disclosure, increasing the urgency for affected organizations. The vulnerability impacts systems where the WebDialer service is enabled, which is often the case in enterprise environments. Cisco has assigned a Critical Security Impact Rating to this vulnerability, despite a CVSS score of 8.6. Administrators are advised to check the status of the WebDialer service and apply security updates promptly. Currently, there is no evidence of active exploitation, but the availability of PoC code raises concerns about potential attacks. Organizations are encouraged to disable the WebDialer service until patches are applied. 8 sources 72

Extracted Entities

PoC Exploit Released for Cisco Unified Communications Manager Security Vulnerability

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (2)