Cisco Unified Communications Manager WebDialer Service server-side request forgery

Summaryinfo

A vulnerability identified as critical has been detected in Cisco Unified Communications Manager. Impacted is an unknown function of the component WebDialer Service. The manipulation leads to server-side request forgery. This vulnerability is listed as CVE-2026-20230. The attack may be initiated remotely. In addition, an exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Cisco Unified Communications Manager (affected version not known). It has been rated as critical. This issue affects some unknown functionality of the component WebDialer Service. The manipulation with an unknown input leads to a server-side request forgery vulnerability. Using CWE to declare the problem leads to CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root. Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root. Note: To exploit this vulnerability, the WebDialer service must be enabled. WebDialer is disabled by default.

The advisory is shared at sec.cloudapps.cisco.com. The identification of this vulnerability is CVE-2026-20230 since 10/08/2025. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are unknown but an exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/02/2026).

It is declared as attacked. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 06/25/2026 with a due date of 06/28/2026:

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BO

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at EUVD (EUVD-2026-34137) and CERT Bund (WID-SEC-2026-1801). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Cisco Unified Communications Manager (CUCM)

Productinfo

Type

• Unified Communication Software

Vendor

• Cisco

Name

• Unified Communications Manager

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion