The vulnerability in the web interface of the Cisco Unified Communications Manager system, the Cisco Unified Communications Manager Session Management Edition (SME) system, the Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) call management system, the integrated Cisco Unity Connection messaging system, and the cloud-based web conference platform Cisco Webex Calling Dedicated Instance allows a malicious actor to execute arbitrary commands and elevate their privileges to the root level.

🗓️ 23 Jan 2026 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

A vulnerability in Cisco Unified Communications Manager family enables arbitrary commands and root access via crafted web requests due to improper code generation.

Reporter	Title	Published	Views	Family All 23
GithubExploit	Exploit for Code Injection in Cisco Unified_Communications_Manager	23 Feb 202617:12	–	githubexploit
ATTACKERKB	CVE-2026-20045	21 Jan 202616:26	–	attackerkb
Circl	CVE-2026-20045	21 Jan 202617:08	–	circl
CISA KEV Catalog	Cisco Unified Communications Products Code Injection Vulnerability	21 Jan 202600:00	–	cisa_kev
CISA	CISA Adds One Known Exploited Vulnerability to Catalog	21 Jan 202612:00	–	cisa
Cisco	Cisco Unified Communications Products Remote Code Execution Vulnerability	21 Jan 202616:00	–	cisco
Tenable Nessus	Cisco Unified Communications Manager (CUCM) Remote Code Execution (cisco-sa-voice-rce-mORhqY4b)	23 Jan 202600:00	–	nessus
Tenable Nessus	Cisco Unified Communications Manager IM & Presence Service Remote Code Execution (cisco-sa-voice-rce-mORhqY4b)	23 Jan 202600:00	–	nessus
Tenable Nessus	Cisco Unity Connection Remote Code Execution (cisco-sa-voice-rce-mORhqY4b)	22 Jan 202600:00	–	nessus
CNNVD	Cisco’s various products have security vulnerabilities	21 Jan 202600:00	–	cnnvd