VulnRadar

Data against noise.

Built with NaN
Page generated: 09 Nov 2026, 03:50 UTC
← Dashboard

CVE-2026-20230

A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected devi…

Read full description
A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root. Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root. Note: To exploit this vulnerability, the WebDialer service must be enabled. WebDialer is disabled by default.
CVSS 8.6 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
0.0/10
REALITY · THREAT PRIORITY
8.7/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 8.6: +1.29
  • Fresh EPSS: 88.53%: +0.44

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 25 documents and public datasets.

Hype components

Headline sample (25%)
0/100
Press, 30 days (60%)
0/100
Grounded branding (15%)
0/100
HYPE TOTAL0/100

Sources and documents

systemtek.co.uk
Press · 05 Oct 2026, 12:02 · OpenAM vulnerability allows server-side request forgery (CVE-2026-105122) - systemtek.co.uk
Recorded Future
Press · 10 Jul 2026, 07:00 · June 2026 CVE Landscape - Recorded Future
BleepingComputer
Press · 02 Jul 2026, 07:00 · Cisco finally confirms attackers exploiting Unified CM flaw - BleepingComputer
Computer Weekly
Press · 02 Jul 2026, 07:00 · US cyber agency warns over forgotten SharePoint flaw - Computer Weekly
Rescana
Press · 30 Jun 2026, 07:00 · Active Exploitation Alert: Critical Oracle E-Business Suite CVE-2026-46817 Vulnerability Targeting Oracle Payments Module - Rescana
See all 25 source documents
Rescana
Press · 29 Jun 2026, 07:00 · Active Exploitation Alert: Cisco CUCM CVE-2026-20230 SSRF-RCE Flaw Weaponized Within 24 Hours of Disclosure - Rescana
BleepingComputer
Press · 26 Jun 2026, 07:00 · CISA sets urgent deadline to fix Cisco flaw exploited in attacks - BleepingComputer
Computing UK
Press · 25 Jun 2026, 07:00 · Cisco Unified Communications flaw exploited by hackers - Computing UK
SecurityWeek
Press · 25 Jun 2026, 07:00 · Cisco SD-WAN Zero-Day Exploited Months Before Patching - SecurityWeek
Dark Reading
Press · 25 Jun 2026, 07:00 · In Less Than 24 Hours, Attackers Weaponize Cisco CUCM Flaw - Dark Reading
Tech Times
Press · 24 Jun 2026, 07:00 · Cisco Unified CM CVE-2026-20230: Webshell Drops Confirmed, Patch Alone Won't Evict Attackers - Tech Times
The Register
Press · 24 Jun 2026, 07:00 · The hits keep on coming for Cisco vulnerabilities - The Register
SecurityWeek
Press · 24 Jun 2026, 07:00 · Hackers Exploiting Cisco Unified CM Vulnerability - SecurityWeek
Help Net Security
Press · 24 Jun 2026, 07:00 · Cisco Unified CM flaw actively exploited to drop webshells (CVE-2026-20230) - Help Net Security
The Hacker News
Press · 24 Jun 2026, 07:00 · Cisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to Root - The Hacker News
Tech Times
Press · 23 Jun 2026, 07:00 · Cisco SD-WAN Logs Seventh Zero-Day of 2026: CISA Patch Deadline Arrives Today - Tech Times
BleepingComputer
Press · 23 Jun 2026, 07:00 · Cisco Unified CM flaw CVE-2026-20230 now exploited in attacks - BleepingComputer
The Hacker News
Press · 06 Jun 2026, 07:00 · Cisco Catalyst SD-WAN Manager CVE-2026-20245 Flaw Actively Exploited - The Hacker News
SOCRadar
Press · 05 Jun 2026, 07:00 · CVE-2026-20230: Cisco Unified CM WebDialer SSRF Can Lead to Root-Level Compromise - SOCRadar
Tech Times
Press · 04 Jun 2026, 07:00 · Cisco Unified CM SSRF Flaw CVE-2026-20230: Public Exploit Code Opens Path to Root - Tech Times
BleepingComputer
Press · 04 Jun 2026, 07:00 · Cisco warns of critical Unified CM flaw with PoC exploit code - BleepingComputer
CyberSecurityNews
Press · 04 Jun 2026, 07:00 · Cisco Unified Communications Manager Vulnerability Exposed Along With PoC Exploit Code - CyberSecurityNews
Security Affairs
Press · 04 Jun 2026, 07:00 · Critical Cisco Unified CM Bug Patched as Public Exploit Code Emerges - Security Affairs
The Hacker News
Press · 04 Jun 2026, 07:00 · Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public - The Hacker News
The Hacker News
Press · 04 Jun 2026, 07:00 · ThreatsDay Bulletin: AI Agents Gone Wrong, Sketchy C2 Tools, ClickFix Tricks, JS Backdoors & 20+ New Stories - The Hacker News

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

024681002 Nov 2026 · OBSERVED EXPLOITATION + LOWER RECENT ATTENTIONHype 1.8Reality 8.705 Nov 2026 · OBSERVED EXPLOITATION + LOWER RECENT ATTENTIONHype 0.0Reality 8.7Nov 2Nov 5

━ Hype Score (Perceived)  ━ Reality threat priority. Definition changes are not new attacks.

Public exploit evidence

0

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 8.6; EPSS 88.5%
Attention, last 30 days
0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential
network access, no prior privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 14:00:00.097835+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
Published
03 Jun 2026, 16:09
First press mention
04 Jun 2026, 07:00
Added to the CISA KEV catalog
25 Jun 2026, 00:00
Latest press mention
05 Oct 2026, 12:02
Score calculated
05 Nov 2026, 14:00
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar