CISA has added a critical server-side request forgery (SSRF) vulnerability affecting Cisco Unified Communications Manager (Unified CM) to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies and organizations to apply patches immediately amid active exploitation in the wild.

The flaw, tracked as CVE-2026-20230, enables unauthenticated remote attackers to perform server-side request forgery (SSRF) attacks — a threat vector increasingly weaponized to gain deep footholds in enterprise infrastructure.

The vulnerability enables an unauthenticated, remote attacker to perform server-side request forgery attacks against the affected system without requiring any credentials.

Critically, successful exploitation could allow attackers to write arbitrary files to the underlying operating system, establishing a foothold that could later be leveraged to escalate privileges to root level, granting full control over the affected host.

The vulnerability was added to CISA’s KEV catalog on June 25, 2026, with a mandatory remediation deadline of June 28, 2026, reflecting the urgent risk posed by active exploitation.

Cisco Unified CM Vulnerability

SSRF vulnerabilities are particularly dangerous in enterprise communication infrastructure because they allow attackers to abuse server-side functionality to interact with internal systems, bypass network controls, and reach otherwise isolated services.

In this case, the file-write capability transforms what might appear to be a limited-scope flaw into a serious pre-authentication remote compromise vector.

An attacker could craft malicious requests to force the Unified CM server to write attacker-controlled content to sensitive file system locations.

These planted files could then be triggered or leveraged in subsequent attack stages to achieve privilege escalation and persistent root-level access a classic multi-stage exploitation chain commonly observed in enterprise breach scenarios.

While CISA currently lists ransomware campaign association as unknown, the nature of the vulnerability, unauthenticated access, combined with file-write and privilege escalation potential, makes it a high-value target for ransomware operators and advanced persistent threat (APT) groups targeting enterprise communication platforms.

Affected Products

• Cisco Unified Communications Manager (Unified CM)
• Cisco Unified Communications Manager Session Management Edition (Unified CM SME)

Organizations running either product in internet-exposed or hybrid environments should treat remediation as an emergency priority.

CISA has directed affected organizations to take the following steps in line with Binding Operational Directive (BOD) 26-04, which governs prioritized security updates based on risk:

• Apply vendor-issued mitigations immediately per Cisco’s official security advisory at cisco-sa-cucm-ssrf-cXPnHcW
• Conduct forensic triage in accordance with CISA’s Forensics Triage Requirements to identify potential indicators of prior compromise
• Evaluate internet exposure of all affected assets and ensure compliance with BOD 26-04 patching timelines
• Discontinue use of the product if mitigations cannot be applied within the prescribed deadline
• For cloud service deployments, follow applicable BOD 26-04 cloud guidance

Security teams are strongly advised to audit Unified CM logs for anomalous outbound requests or unexpected file system modifications as immediate post-detection measures.

Windows Secure Boot Certificates to Expire – What IT Teams Should Do Before the Deadline.