VulnRadar

Data against noise.

Page generated: 11 Nov 2026, 02:47 UTC

CVE-2026-20045

Read full description

A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device.  This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root.  Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.

CVSS 8.2 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

0.0/10

REALITY · THREAT PRIORITY

8.3/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 8.2: +1.23
Fresh EPSS: 4.54%: +0.02

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 18 documents and public datasets.

Hype components

Headline sample (25%)

0/100

Press, 30 days (60%)

0/100

Grounded branding (15%)

0/100

HYPE TOTAL0/100

Sources and documents

Help Net Security

Press · 24 Jun 2026, 07:00 · Cisco Unified CM flaw actively exploited to drop webshells (CVE-2026-20230) - Help Net Security

BleepingComputer

Press · 04 Jun 2026, 07:00 · Cisco warns of critical Unified CM flaw with PoC exploit code - BleepingComputer

The Hacker News

Press · 04 Jun 2026, 07:00 · Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public - The Hacker News

Help Net Security

Press · 20 Mar 2026, 07:00 · Cisco FMC flaw was exploited by Interlock weeks before patch (CVE-2026-20131) - Help Net Security

Recorded Future

Press · 24 Feb 2026, 08:00 · January 2026 CVE Landscape: 23 Critical Vulnerabilities Mark 5% Increase, APT28 Exploits Microsoft Office Zero-Day - Recorded Future

See all 18 source documents

SOC Prime

Press · 28 Jan 2026, 08:00 · CVE-2026-24858: FortiOS SSO Zero-Day Exploited in the Wild - SOC Prime

Dark Reading

Press · 26 Jan 2026, 08:00 · Exploited Zero-Day Flaw in Cisco UC Could Affect Millions - Dark Reading

Help Net Security

Press · 25 Jan 2026, 08:00 · Week in review: Fully patched FortiGate firewalls are getting compromised, attackers probe Cisco RCE flaw - Help Net Security

Cyber Security Agency of Singapore

Press · 23 Jan 2026, 08:00 · High Severity Vulnerability in Cisco Products - Cyber Security Agency of Singapore

SecurityWeek

Press · 22 Jan 2026, 08:00 · Hackers Targeting Cisco Unified CM Zero-Day - SecurityWeek

Hong Kong Computer Emergency Response Team Coordination Centre

Press · 22 Jan 2026, 08:00 · Cisco Products Multiple Vulnerabilities - Hong Kong Computer Emergency Response Team Coordination Centre

The Hacker News

Press · 22 Jan 2026, 08:00 · Cisco Fixes Actively Exploited Zero-Day CVE-2026-20045 in Unified CM and Webex - The Hacker News

Cyber Daily

Press · 22 Jan 2026, 08:00 · Cisco addresses Unified Communications vulnerability as active exploitation underway - Cyber Daily

CyberSecurityNews

Press · 22 Jan 2026, 08:00 · Cisco Unified Communications 0-day RCE Vulnerability Exploited in the Wild to Gain Root Access - CyberSecurityNews

SOC Prime

Press · 22 Jan 2026, 08:00 · CVE-2026-20045: Critical Zero-Day in Cisco Products Is Actively Exploited in the Wild - SOC Prime

BleepingComputer

Press · 21 Jan 2026, 08:00 · Cisco fixes Unified Communications RCE zero day exploited in attacks - BleepingComputer

Help Net Security

Press · 21 Jan 2026, 08:00 · RCE flaw in Cisco enterprise communications products probed by attackers (CVE-2026-20045) - Help Net Security

Arctic Wolf

Press · 21 Jan 2026, 08:00 · Recommendation for CVE‑2026‑20045 - Arctic Wolf

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.3 (2026-11-02 15:14). The curve appears once the score changes.

Public exploit evidence

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 8.2; EPSS 4.5%
Attention, last 30 days: 0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential: network access, no prior privileges, no user interaction.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-05 14:00:00.097835+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

Added to the CISA KEV catalog

21 Jan 2026, 00:00

First press mention

21 Jan 2026, 08:00

Published

21 Jan 2026, 16:26

Latest press mention

24 Jun 2026, 07:00

Score calculated

05 Nov 2026, 14:00