Cisco Unified CM Vulnerability (CVE-2026-20230, CVSS 8.6) Actively Exploited for Root Privilege Escalation

CVE-2026-20230 has a CVSS score of 8.6 and stems from improper input validation for specific HTTP requests.

Successful exploitation can let an unauthenticated remote attacker perform server-side request forgery through the affected device.

Active exploitation has been observed in attacks using an unvetted proof of concept with file:// payloads landing on decoys.

Exploitation requires the WebDialer service to be enabled, which is disabled by default.

The flaw is patched in Unified CM and Unified CM SME versions 14SU6 and 15SU5, and disabling WebDialer is recommended if patching is not immediately possible.