Skip to content
VulniPulse
Sign in
Highest advisory severityHigh Exploited CISA KEV 1 vendor · 1 advisory

CVE-2026-20230

CVE-2026-20230: 1 tracked advisory record across Cisco. CISA KEV listed; exploitation observed. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Cisco

1 advisory
  • Advisory severityHigh8.6

    High [CVE-2026-20230] Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability

    cisco-sa-cucm-ssrf-cXPnHcWSource published Source updated

    A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root. Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability…

    Related products — impact not confirmed
    • Unified Communications Manager
    Source-reported affected versions
    • Scope: This vulnerability affects Cisco Unified CM and Unified CM SME if they have the WebDialer service enabled.
    • Release 14 (first fixed: 14SU6)
    • Release 15 (first fixed: 15SU5 (Sep 2026) or COP1)
    Source-reported fixed versions
    • 14SU6
    • 15SU5 (Sep 2026) or COP1
    Mitigation guidance
    • Upgrade to the first fixed release for your train per the Fixed Releases table in this advisory.
    • Release 14: upgrade to 14SU6.
    • Release 15: upgrade to 15SU5 (Sep 2026) or COP1.
    Workarounds
    • There are no workarounds that address this vulnerability. However, as a mitigation, administrators may disable the WebDialer service until a patch can be applied.
    • To disable WebDialer, complete the following steps:
    • Log in to the Cisco Unified CM Administration interface.
    • From the Navigation menu, choose Cisco Unified Serviceability and click Go.

    2 more entries in the full advisory.

    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Monitor future Cisco CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features