Cisco Patches Actively Exploited Flaw in Unified Communications Products
Take action: If you are using Cisco communication platforms, read this advisory in detail. Make sure the web management interface are isolated from the internet and accessible from trusted networks only. Then plan a quick update. Because someone will find a way to reach the vulnerable interface even if it's isolated.
Learn More
Cisco released emergency fixes for a critical vulnerability in its enterprise communication tools.The flaw allows hackers to take over systems that manage corporate phone calls, messaging, and voicemail. Cisco's Product Security Incident Response Team (PSIRT) confirmed they are detecting active attempts to exploit this flaw.
The flaw is tracked as CVE-2026-20045 (CVSS score 8.2, Cisco score Critical) - a code injection vulnerability in the web-based management interface. Attackers send a series of specially made HTTP requests. Because the system does not check this input correctly, the attacker can run their own commands without authentication.
A successful compromise gets the attacker a user-level access to the operating system. From there, they can raise their permissions to root and get complete control over the server. They can listen to calls, read messages, or use the server to attack other parts of the network.
Affected systems are:
- Cisco Unified Communications Manager (Unified CM) and Session Management Edition (SME).
- Cisco Unified Communications Manager IM & Presence Service
- Cisco Unity Connection
- Webex Calling Dedicated Instance is affected for cloud-hosted users.
There are no workarounds to stop an attack. Cisco advises all users to update their software immediately. If you use version 12.5, you must move to a newer version because it is no longer supported. For versions 14 and 15, Cisco provided specific patch path:
Unified CM, Unified CM IM&P, Unified CM SME, and Webex Calling Dedicated Instance
| Cisco Unified CM, Unified CM IM&P, Unified CM SME, and Webex Calling Dedicated Instance Release | First Fixed Release |
|---|---|
| 12.5 | Migrate to a fixed release. |
| 14 | 14SU5 or apply patch file:1 ciscocm.V14SU4a_CSCwr21851_remote_code_v1.cop.sha512 |
| 15 | 15SU4 (Mar 2026) or apply patch file:1 ciscocm.V15SU2_CSCwr21851_remote_code_v1.cop.sha512 ciscocm.V15SU3_CSCwr21851_remote_code_v1.cop.sha512 |
Unity Connection
| Cisco Unity Connection Release | First Fixed Release |
|---|---|
| 12.5 | Migrate to a fixed release. |
| 14 | 14SU5 or apply patch file:1 ciscocm.cuc.CSCwr29208_C0266-1.cop.sha512 |
| 15 | 15SU4 (Mar 2026) or apply patch file:1 ciscocm.cuc.CSCwr29208_C0266-1.cop.sha512 |
