Critical RCE Vulnerability in Cisco Unified Communications
A critical remote code execution (RCE) vulnerability has been discovered in Cisco's Unified Communications and Webex Calling, tracked as CVE-2026-20045. This vulnerability affects several Cisco products, including Unified Communications Manager, Unified CM Session Management Edition, Unified CM IM & Presence, Cisco Unity Connection, and Webex Calling Dedicated Instance. The vulnerability is due to improper validation of user-supplied input in HTTP requests, allowing an attacker to send crafted HTTP requests to the web-based management interface of an affected device. As a result, an attacker could obtain user-level access to the underlying operating system and then elevate privileges to root. The vulnerability has a CVSS score of 8.2 and has been assigned a Critical severity rating by Cisco.
The attack vector involves sending a sequence of crafted HTTP requests to the web-based management interface of an affected device. This can be done by exploiting the improper validation of user-supplied input in HTTP requests, which allows an attacker to inject malicious code. Once the malicious code is injected, the attacker can obtain user-level access to the underlying operating system and then elevate privileges to root. The exploitation chain involves multiple steps, including sending crafted HTTP requests, injecting malicious code, and elevating privileges. The delivery method of the exploit is not specified, but it is likely that the attacker would use social engineering or phishing tactics to gain access to the affected device. The technical explanation of the attack vector and delivery method is complex and requires a deep understanding of the affected products and their configurations.
The vulnerability has significant strategic implications, as it allows an attacker to gain root access to the affected device. This could lead to a range of malicious activities, including data theft, system compromise, and lateral movement. The current exploitation status of the vulnerability is active, with Cisco's Product Security Incident Response Team (PSIRT) confirming that attempts to exploit the flaw have been observed in the wild. As a result, Cisco is urging customers to upgrade to the latest software as soon as possible. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-20045 to its Known Exploited Vulnerabilities (KEV) Catalog and given federal agencies until February 11, 2026, to deploy updates. To mitigate the vulnerability, customers should upgrade to the latest software version, apply the recommended patch files, and review the README before applying patches.
Attack Surface
Endpoint, Server OS, Web Application
Tactics
Execution, Privilege Escalation, Initial Access
Techniques
- T1190 – Exploit Public-Facing Application
SuperPRO's Threat Countermeasures Procedures
- Upgrade Cisco Unified Communications Manager to version 12.5 or later
- Apply patch file ciscocm.V14SU4a_CSCwr21851_remote_code_v1.cop.sha512 for version 14
- Apply patch file ciscocm.V15SU2_CSCwr21851_remote_code_v1.cop.sha512 for version 15
- Review the README before applying patches
- Upgrade Cisco Unity Connection to version 12.5 or later
- Apply patch file ciscocm.cuc.CSCwr29208_C0266-1.cop.sha512 for version 14 and 15
- Monitor system logs for suspicious activity