Cisco Unified CM CVE-2026-20230: attackers are dropping webshells

A flaw that can be abused without any login has been found in Cisco Unified Communications Manager (Unified CM), the software many companies use to run their phone systems. Tracked as CVE-2026-20230, it is already being exploited in real attacks, and the U.S. government's cyber agency is urging urgent action.

By abusing this flaw, an attacker can write files onto the server from the outside and, ultimately, seize the system's highest privilege (root, the do-anything administrator account). On June 25, 2026, the U.S. agency CISA added it to its Known Exploited Vulnerabilities (KEV) catalog and set a June 28 deadline for federal agencies to act.

That said, not every organization is immediately at risk. Exploitation requires a particular setting that is turned off by default. Here is what is going on, including how to tell whether your organization is affected.

What Cisco Unified CM does

Unified CM is software that controls a company's phones and video calls as a whole. It manages employee extensions, routes incoming and outgoing calls, and connects IP phones and softphones — essentially the brain of the office phone exchange. It is widely deployed across mid-size and large enterprises, call centers, and government bodies, and if it goes down, internal and external calls stop all at once.

The flaw affects both Unified CM itself and the higher-tier Unified CM Session Management Edition (SME), which ties multiple sites together. With the phone foundation at risk of being taken over across the internet, the impact reaches well beyond calls.

Files written from outside, all the way to root

At the core is a class of flaw called SSRF. SSRF (server-side request forgery) is a technique where an outside attacker sends a crafted request and makes the server itself carry out the communication or action the attacker intends on their behalf.

Here, Unified CM processes the contents of certain HTTP requests (the protocol behind web traffic) without checking them properly. According to Cisco's official advisory, an unauthenticated, remote attacker can send a crafted request and write arbitrary files onto the underlying operating system.

What follows is the frightening part. According to a technical write-up by SSD Secure Disclosure, the firm that first reported the flaw, that file-write ability can be chained with other weaknesses to run code freely on the server and ultimately escalate to root. The phone management server could become entirely the attacker's. The severity is 8.6 on the 10-point CVSS scale, but Cisco has raised its own Security Impact Rating to the top level, "Critical," because it can lead to a full root takeover.

Who would exploit this, and why

The people who target this flaw are attackers who can reach a company's phone management server directly from the internet. They do not need to steal credentials or sneak inside the network. With the public exploit code, even less-skilled attackers can give it a try.

Their goal is to use the phone server as an entry point to seize the highest privilege on the internal network and push deeper from there. Phone infrastructure is often tightly connected to other internal systems, so taking it over enables not only call eavesdropping and spoofed outbound calls but a foothold into the whole organization.

"Behind-the-scenes" gear like a phone exchange keeps running without anyone paying attention day to day. That is exactly why an intrusion can go unnoticed and why it makes an easy place for attackers to linger. Cisco products have repeatedly faced attacks that seize the highest privilege through flaws in their management systems, such as a privilege escalation in the SD-WAN Manager network tool. Enterprise admin consoles are a place attackers always watch.

Attacks are already underway

Cisco published the flaw and its fix on June 3, 2026. About three weeks later, exploitation attempts were observed. The threat-intelligence firm Defused confirmed attacks against its decoy servers coming from a single source. The first attacks made public used file://-style file-write requests trying to plant a test file named /tmp/cve-2026-20230-test.txt.

The activity did not stop there. Two days later, on June 24, the same Defused honeypots showed automated scanning over Tor dropping webshells. A webshell is a small program left on the server that lets an attacker run commands on it by sending ordinary HTTP requests from a browser or script. So this was not just hunting for vulnerable servers — attackers were getting in and settling down.

Cisco has since confirmed it too, acknowledging active exploitation in the July 1 update to its advisory (Revision 1.1). The text now says the PSIRT became aware of active exploitation in June 2026, replacing the original "no evidence of exploitation" line.

← swipe to move

The attack chain: from SSRF to a webshell

The observed attacks take over a server in four moves. They show how a flaw that only lets you write one file grows into a foothold for remote control.

Once stage four lands, the attacker never has to touch the vulnerability again. Sending an HTTP request to the planted shell is enough to come back at any time. And since the traffic was automated scanning over Tor rather than hand-picked targeting, no one gets singled out — anything exposed to the internet gets its turn.

The pool of targets is not small either. Shadowserver is tracking more than 200 internet-exposed Unified CM instances, concentrated in Asia and North America.

Is your organization affected?

This is the most important point. For the attack to work, Unified CM's "WebDialer" service must be enabled. WebDialer lets users place calls from their computer screen, and according to Cisco, it is disabled by default.

In other words, even on a vulnerable version, you are not in an immediately exploitable state if WebDialer is off. Conversely, organizations that have enabled WebDialer for business use are at higher risk and should act first. Start by checking in the admin console whether your Unified CM uses WebDialer. The table below helps you match your version against the affected range.

What to do right now

It helps to think in two layers: the real fix is applying the patch, and the stopgap is turning off the feature.

1. Update to the fixed version (the real fix). Move 14.x to 14SU6 or later, and 15.x to 15SU5 (release due September 2026). To protect 15.x right away, you can apply Cisco's standalone patch (a COP file). Apply the matching fix to SME as well. Always confirm the exact affected releases and download sources in Cisco's official advisory.

2. If you cannot update yet, disable the feature (stopgap). If you do not use WebDialer for business, disabling the "Cisco WebDialer Web Service" from the management tool (Cisco Unified Serviceability) closes the attack path. This is only a temporary workaround; the real answer is applying the patch.

This flaw is already on CISA's Known Exploited Vulnerabilities (KEV) catalog, with a remediation deadline of June 28. That deadline is for federal agencies, but with exploitation underway, private companies should treat it as a target and move quickly. Similar admin-console flaws have demanded urgent action in past Cisco products too.

Worth keeping straight

The phone foundation is an easily overlooked weak spot

This flaw began to be exploited about three weeks after the fix came out, and it took only days from there to reach webshell deployment. The gap between a patch and real attacks keeps shrinking year by year. The instinct to "test carefully before updating such a critical server" can end up handing attackers the time they need.

The saving grace is that the attack condition here is clear (WebDialer enabled), and disabling the feature is a fast-acting workaround. Check your own settings first, and if they apply, hurry to patch or turn the feature off — then check whether something has already been planted. Treating the quietly running foundations like a phone exchange as a prime target attackers stalk is the shortest path to staying safe.

Sources

• ▸ Cisco - Security Advisory cisco-sa-cucm-ssrf-cXPnHcW (CVE-2026-20230)
• ▸ Cisco Security Advisory full text (Rev 1.1, active exploitation statement)
• ▸ NVD - CVE-2026-20230 detail
• ▸ CISA - Known Exploited Vulnerabilities Catalog
• ▸ BleepingComputer - Cisco Unified CM flaw CVE-2026-20230 now exploited in attacks
• ▸ Security Affairs - Cisco Unified CM flaw actively exploited in the wild
• ▸ CSO Online - Attackers exploit Cisco Unified CM flaw weeks after patch release
• ▸ Horizon3.ai - CVE-2026-20230: Cisco Unified CM SSRF
• ▸ Help Net Security - Cisco Unified CM flaw exploited to drop webshells
• ▸ Tech Times - Webshell drops confirmed; patch alone won't evict attackers
• ▸ BleepingComputer - Cisco finally confirms attackers exploiting Unified CM flaw
• ▸ SecurityWeek - Cisco confirms in-the-wild exploitation of Unified CM vulnerability