CVE-2026-20230: CVE-2026-20230: Server-Side Request Forgery in Cisco Unified Communications Manager WebDialer Service

#security #cve #cybersecurity

CVE-2026-20230: Server-Side Request Forgery in Cisco Unified Communications Manager WebDialer Service

Vulnerability ID: CVE-2026-20230
CVSS Score: 8.6
Published: 2026-06-03

CVE-2026-20230 is a critical Server-Side Request Forgery (SSRF) vulnerability in the WebDialer service of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME). The flaw arises from improper validation of input parameters within WebDialer HTTP requests. Unauthenticated remote attackers can exploit this vulnerability to force the application to make HTTP requests to internal administrative services bound to the loopback interface. In the Cisco Voice Operating System (VOS) environment, these local services trust loopback traffic inherently, permitting unauthorized file writes. By writing malicious files to specific system directories, the attacker can execute arbitrary commands with root privileges.

TL;DR

Improper input validation in the WebDialer service of Cisco Unified CM enables unauthenticated remote attackers to execute a Server-Side Request Forgery (SSRF). This vulnerability allows attackers to query internal loopback APIs, write malicious files to the filesystem, and escalate privileges to root.

Technical Details

Vulnerability ID: CVE-2026-20230
CWE ID: CWE-918
Attack Vector: Network (AV:N)
CVSS v3.1 Score: 8.6 (Critical Severity Impact Rating)
Exploit Status: None (No public exploit code or active exploitation detected)
CISA KEV Status: No

Affected Systems

Cisco Unified Communications Manager (Unified CM)
Cisco Unified Communications Manager Session Management Edition (Unified CM SME)
Cisco Unified Communications Manager: All versions where WebDialer is active and unpatched (Fixed in: Refer to cisco-sa-cucm-ssrf-cXPnHcW)
Cisco Unified Communications Manager SME: All versions where WebDialer is active and unpatched (Fixed in: Refer to cisco-sa-cucm-ssrf-cXPnHcW)

Mitigation Strategies

Disable the WebDialer service if it is not actively required for telephony operations.
Apply network-level firewall rules to restrict access to Unified CM administrative and application interfaces.
Upgrade Cisco Unified CM and Unified CM SME to a supported software version containing the security patch.

Remediation Steps:

Log in to the Cisco Unified Serviceability page on the target node.
Go to Tools -> Service Activation and check the status of Cisco WebDialer. If active and unnecessary, deactivate the service.
Download the authorized system update package from the official Cisco Software Download Portal.
Apply the patch or software update during a scheduled maintenance window in accordance with Cisco's deployment guidelines.
Verify that the vulnerability is remediated by checking the software build version against the advisory's fixed releases list.