Research and tooling Northern Reach
Offensive security tooling, adversary emulation, research & analysis.

Cisco Unified CM (CVE-2026-20230) Active Exploitation

CVE | CRITICAL severity | CVSS 8.6 CVE-2026-20230 Published 2026-06-03

Executive Summary

CVE-2026-20230 is a server-side request forgery (SSRF) vulnerability in Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (Unified CM SME). An unauthenticated, remote attacker can exploit improper input validation in the /cmplatform/installClusterStatusExecute endpoint to write arbitrary files to the underlying operating system. These files serve as a foothold for root-level code execution.

Cisco published the advisory on June 3, 2026, rating it Critical — above the CVSS 8.6 base score — because the file write enables full root compromise. Proof-of-concept exploit code is public. SSD Secure Disclosure published a complete exploit chain on June 23, 2026. On June 24, 2026, Defused Cyber confirmed active exploitation from a single source against deployed decoys.

The vulnerability requires the WebDialer service, which is disabled by default. Organizations with WebDialer enabled are exposed. Patches are available in Unified CM 14SU6 and an interim COP file for version 15. A full 15SU5 release is scheduled for September 2026. No workarounds exist, but disabling WebDialer mitigates the risk until patching.

Timeline

Date Event Source
Prior to 2026-06-03 Independent researcher working with SSD Secure Disclosure reports vulnerability to Cisco Cisco PSIRT
2026-06-03 Cisco publishes advisory cisco-sa-cucm-ssrf-cXPnHcW, releases 14SU6 fix Cisco PSIRT
2026-06-04 The Hacker News reports on patch and availability of public PoC exploit code The Hacker News
2026-06-05 First public GitHub PoC repository published (HORKimhab/CVE-2026-20230) GitHub
2026-06-12 CVE-2026-20230 scanner tool published on GitHub (HalilDeniz/CVE-2026-20230-Scanner) GitHub
2026-06-23 SSD Secure Disclosure publishes full technical root cause analysis and exploit chain SSD Secure Disclosure
2026-06-24 Defused Cyber observes active exploitation; The Hacker News reports exploitation status Defused Cyber, The Hacker News
2026-09 (planned) Unified CM 15SU5 full release expected Cisco PSIRT

Technical Analysis

Affected Systems and Software

  • Cisco Unified Communications Manager (Unified CM), releases 14 prior to 14SU6
  • Cisco Unified Communications Manager (Unified CM), releases 15 prior to 15SU5 or the interim COP patch
  • Cisco Unified Communications Manager Session Management Edition (Unified CM SME), same version ranges

Only deployments with the WebDialer service enabled are exploitable. WebDialer ships disabled by default. To check status: log in to Cisco Unified CM Administration, navigate to Cisco Unified Serviceability, then choose Tools > Control Center - Feature Services. If Cisco WebDialer Web Service shows status "Started," the system is vulnerable.

Root Cause

The vulnerability is a server-side request forgery in the ClusterInstallStatusServlet at the /cmplatform/installClusterStatusExecute endpoint. When action=clusterNodeInstallStatus, the servlet makes an outbound HTTP request to a user-supplied hostname parameter.

The servlet delegates to NodeInstallStageClient#getInstallStage, which constructs a URL from the hostname parameter and issues the request via JerseyClient#doGet. An InjectionFilter performs host validation to block requests to 127.0.0.1 and localhost. However, the true hostname of the target can be obtained through the unauthenticated endpoint /webdialer/Version.jws?wsdl, bypassing the filter.

The attack chains three weaknesses:

  1. The SSRF accepts an arbitrary path appended after the validated hostname, including URL-encoded path traversal sequences.
  2. The response from the SSRF target is written to a file on the CUCM server. By prepending the payload with !--, the attacker escapes the normal XML preamble written by the installstages endpoint and injects arbitrary XML content.
  3. The injected XML is a malicious Axis deployment descriptor that registers a new Axis SOAP service (randomR11) with a LogHandler configured to write arbitrary content to an attacker-controlled file path.

The technique is nearly identical to CVE-2019-0227, a historical Axis 1.4 arbitrary file-write vulnerability, repurposed against Cisco's Axis-based SOAP stack.

Attack Vector

The exploit proceeds in three stages:

Stage 1 — Hostname reconnaissance. The attacker queries the unauthenticated /webdialer/Version.jws?wsdl endpoint to retrieve the server's true hostname.

Stage 2 — Malicious service deployment via SSRF. The attacker sends a crafted GET request to /cmplatform/installClusterStatusExecute?action=clusterNodeInstallStatus with a hostname parameter that contains:

  • The true hostname from Stage 1
  • A URL-encoded path to the /webdialer/services/AdminService/platformcom/api/v1/software/installstages/ endpoint
  • An !-- escape sequence followed by a malicious Axis deployment descriptor that registers a new service (randomR11) and configures its LogHandler to write to ../../../../../../../../../../../../../common/log/taos-log-a/tomcat/webapps/platform-services/axis2-web/aaa.jsp

The server follows the SSRF path, the installstages endpoint writes XML that includes the escaped payload, and the result is a new Axis service deployed on the target.

Stage 3 — Webshell delivery and execution. The attacker uses the newly registered randomR11 service at /webdialer/services/randomR11 to write a JSP webshell to a web-accessible path. The webshell accepts pwd (password) and i (command) parameters and executes arbitrary OS commands via Runtime.getRuntime().exec(). The attacker accesses the webshell at /platform-services/axis2-web/c.jsp and achieves root-level code execution.

All requests are sent over HTTPS with no authentication required.

Vulnerable Code

The /jakarta-tomcat/webapps/cmplatform/WEB-INF/web.xml file exposes the vulnerable endpoint without authentication:

<servlet>
  <servlet-name>installCluster</servlet-name>
  <servlet-class>com.cisco.ccm.cmplatform.servlets.ClusterInstallStatusServlet</servlet-class>
  <load-on-startup>1</load-on-startup>
</servlet>

<servlet-mapping>
  <servlet-name>installCluster</servlet-name>
  <url-pattern>/installClusterStatusExecute</url-pattern>
</servlet-mapping>

The hostHeaderValidation method in com.cisco.ccm.common.security.InjectionFilter blocks 127.0.0.1 and localhost but does not prevent the attacker from using the server's true hostname, which is leaked by the unauthenticated WebDialer WSDL endpoint.

Impact

End Users

No end-user data is directly exposed by this vulnerability. The exploit targets the CUCM server infrastructure itself. End users of the affected organization's voice and telephony services may experience service disruption in the event of a compromise. No personal information, call records, or voicemail data is accessed through the exploit chain itself, though an attacker with root access could pivot to any data stored on or accessible from the CUCM server.

System Administrators

Detection. Check WebDialer status immediately. From Cisco Unified CM Administration, go to Cisco Unified Serviceability > Tools > Control Center - Feature Services. If Cisco WebDialer Web Service is "Started," the system is exposed.

Patching. Upgrade to Unified CM 14SU6 (available now) or apply the COP patch for version 15. The full 15SU5 release arrives September 2026. Cisco provides patch details at the advisory URL below.

Mitigation. If patching is not immediately possible, disable the WebDialer service: navigate to Cisco Unified Serviceability > Tools > Service Activation, uncheck Cisco WebDialer Web Service in the CTI Services section, and click Save. This fully blocks the attack vector.

Log monitoring. Monitor access logs for requests to /cmplatform/installClusterStatusExecute with the action=clusterNodeInstallStatus parameter. Look for long, URL-encoded hostname values containing %21%2d%2d (the !-- escape sequence) or path traversal patterns (%2e%2e%2f). Monitor for access to /webdialer/Version.jws?wsdl from unexpected sources.

Network segmentation. Restrict access to CUCM administrative interfaces and the WebDialer service to trusted internal networks. The vulnerability requires the attacker to reach the CUCM server over HTTPS on the standard management port.

Vulnerability scanners. At the time of this report, no Nessus plugin IDs or Qualys QIDs specific to CVE-2026-20230 were identified. The public scanner by HalilDeniz on GitHub (CVE-2026-20230-Scanner) can be used to check for exposure.

Developers

This vulnerability does not affect libraries or frameworks maintained outside of Cisco. Developers who operate CUCM infrastructure should follow the administrator guidance above. Third-party integrations with CUCM (via AXL, JTAPI, or the administrative SOAP APIs) are not affected — the vulnerability is in the server-side platform code, not the integration APIs.

Developers building custom telephony applications on top of CUCM should ensure their deployment pipelines pin CUCM to patched versions and include WebDialer status checks in security hardening scripts.

Proof-of-Concept and Exploit Code

HORKimhab/CVE-2026-20230 (GitHub — PoC)

  • Classification: PoC
  • Language: Python
  • Stars: 1 — Last updated 2026-06-25
  • Description: CVE-2026-20230 - Cisco Unified CM

HalilDeniz/CVE-2026-20230-Scanner (GitHub — Scanner)

  • Classification: Scanner
  • Language: Python
  • Stars: 0 — Last updated 2026-06-13
  • Description: Cisco Unified Communications Manager (Unified CM) deployments affected by CVE-2026-20230. Licensed under MIT.

W5M1n9/Cisco-Unified-Communications-Manager-Server-Side-Forgery-Request-Vulnerability-CVE-2026-20230 (GitHub — PoC)

  • Classification: PoC
  • Language: Python
  • Stars: 0 — Last updated 2026-06-25
  • Description: No description provided.

No PoCs were found on GitLab or Codeberg as of 2026-06-25. SSD Secure Disclosure published a complete exploit walkthrough with decoded payloads on June 23, 2026, providing sufficient detail to reproduce the attack chain.

Indicators of Compromise

File Hashes

None available as of 2026-06-25. The exploit is an on-the-wire attack chain that does not drop identifiable malware binaries; it writes a JSP webshell directly to the server filesystem.

Network Indicators

None available from threat intelligence sources. Defused Cyber reported exploitation from a single source IP using file:// file-write payloads, but no IP was publicly disclosed.

YARA Rules

None found. Rules may be contributed at YARAHQ.

Suricata / Snort Signatures

None identified as of 2026-06-25.

Sigma Rules

None found. Search SigmaHQ for community rules.

Threat Hunting Queries

Splunk — Detect SSRF exploitation attempts against CUCM

index=web sourcetype="cisco:cucm:access"
  | where uri_path="/cmplatform/installClusterStatusExecute"
    AND uri_query LIKE "%action=clusterNodeInstallStatus%"
    AND uri_query LIKE "%hostname=%"
  | table _time, client_ip, uri_path, uri_query, status

Splunk — Detect WebDialer hostname reconnaissance

index=web sourcetype="cisco:cucm:access"
  | where uri_path="*/webdialer/Version.jws*"
    AND uri_query="wsdl"
    AND NOT client_ip IN ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")
  | table _time, client_ip, uri_path, status

KQL (Microsoft Sentinel / Defender) — Detect encoded SSRF payloads

CommonSecurityLog
| where RequestURL contains "/cmplatform/installClusterStatusExecute"
    and RequestURL contains "action=clusterNodeInstallStatus"
    and RequestURL contains "%21%2d%2d"
| project TimeGenerated, SourceIP, RequestURL, DestinationIP

KQL — Detect new JSP file creation via webshell

DeviceFileEvents
| where FolderPath contains "axis2-web"
    and FileName endswith ".jsp"
    and InitiatingProcessCommandLine contains "tomcat"
| project Timestamp, DeviceName, FolderPath, FileName, InitiatingProcessCommandLine

Mitigation and Remediation

Immediate Actions

  1. Check WebDialer status. Log in to Cisco Unified CM Administration, navigate to Cisco Unified Serviceability > Tools > Control Center - Feature Services, and check the Cisco WebDialer Web Service status in the CTI Services section. If "Started," the system is exposed.

  2. Disable WebDialer if not operationally required. Go to Cisco Unified Serviceability > Tools > Service Activation, uncheck Cisco WebDialer Web Service, and click Save. This fully blocks the attack vector. No exploit path exists without WebDialer.

  3. Patch. Upgrade to Unified CM 14SU6. For version 15 deployments, contact Cisco TAC for the interim COP file. Reference Cisco advisory cisco-sa-cucm-ssrf-cXPnHcW.

  4. Audit for compromise. Check for unexpected JSP files in /tomcat/webapps/platform-services/axis2-web/. Look for recently modified files in /common/log/taos-log-a/tomcat/webapps/. Review the Axis service list at the /webdialer/services endpoint for unknown service names (e.g., randomR11 or similar random strings).

Long-term Recommendations

  1. Disable WebDialer permanently if the feature is unused. Cisco ships it disabled by default; re-enabling it after patching reintroduces attack surface.

  2. Restrict network access to CUCM administrative interfaces at the firewall or network ACL level. The /cmplatform/ and /webdialer/ paths should not be reachable from untrusted networks.

  3. Monitor CUCM release notes and subscribe to Cisco PSIRT notifications for future advisories. Unified CM has a history of unauthenticated root-level vulnerabilities (CVE-2025-20309, CVSS 10; CVE-2026-20045, actively exploited).

  4. Integrate CUCM access logs into the SIEM and deploy the hunting queries above as alert rules.

Vendor Advisories

References

  1. Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability — Cisco PSIRT (2026-06-03)
  2. Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public — The Hacker News (2026-06-04)
  3. Cisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to Root — The Hacker News (2026-06-24)
  4. Cisco Unified Communications Manager Arbitrary File Write to RCE — SSD Secure Disclosure (2026-06-23)
  5. HORKimhab/CVE-2026-20230 — GitHub (2026-06-05)
  6. HalilDeniz/CVE-2026-20230-Scanner — GitHub (2026-06-12)
  7. Defused Cyber — Active exploitation observation — Defused Cyber via X (2026-06-24)