CVE-2026-20230

🗓️ 03 Jun 2026 16:09:45Reported by ciscoType

cve🔗 web.nvd.nist.gov📰️ 18 Media mentions👁 163 Views🌐 WEB

SSRF in Cisco Unified Communications Manager enables unauthenticated file writes and root access when WebDialer is enabled.

Reporter	Title	Published	Views	Family All 20
GithubExploit	Exploit for CVE-2026-20230	12 Jun 202619:47	–	githubexploit
GithubExploit	Exploit for CVE-2026-20230	25 Jun 202609:56	–	githubexploit
ATTACKERKB	CVE-2026-20230	3 Jun 202616:09	–	attackerkb
BDU FSTEC	The vulnerability of the WebDialer service in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) allows a attacker to perform an SSRF attack.	5 Jun 202600:00	–	bdu_fstec
Circl	CVE-2026-20230	3 Jun 202612:22	–	circl
CISA KEV Catalog	Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability	25 Jun 202600:00	–	cisa_kev
Cisco	Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability	3 Jun 202616:00	–	cisco
Tenable Nessus	Cisco Unified Communications Manager (CUCM) 14.x < 14SU6 / 15.x < 15SU5 SSRF (cisco-sa-cucm-ssrf-cXPnHcW)	5 Jun 202600:00	–	nessus
CNNVD	Cisco Unified Communications Manager 代码问题漏洞	3 Jun 202600:00	–	cnnvd
Cvelist	CVE-2026-20230 Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability	3 Jun 202616:09	–	cvelist

NVD

Node

cisco unified_communications_managerRange14.0–14su6-

cisco unified_communications_managerRange14.0–14su6session_management

cisco unified_communications_managerRange15.0–15su4a-

cisco unified_communications_managerRange15.0–15su4asession_management

[
  {
    "vendor": "Cisco",
    "product": "Cisco Unified Communications Manager",
    "versions": [
      {
        "version": "14",
        "status": "affected"
      },
      {
        "version": "14SU1",
        "status": "affected"
      },
      {
        "version": "14SU2",
        "status": "affected"
      },
      {
        "version": "14SU3",
        "status": "affected"
      },
      {
        "version": "15",
        "status": "affected"
      },
      {
        "version": "15SU1",
        "status": "affected"
      },
      {
        "version": "14SU4",
        "status": "affected"
      },
      {
        "version": "14SU4a",
        "status": "affected"
      },
      {
        "version": "15SU1a",
        "status": "affected"
      },
      {
        "version": "15SU2",
        "status": "affected"
      },
      {
        "version": "15.0.1.13010-1",
        "status": "affected"
      },
      {
        "version": "15.0.1.13011-1",
        "status": "affected"
      },
      {
        "version": "15.0.1.13012-1",
        "status": "affected"
      },
      {
        "version": "15.0.1.13013-1",
        "status": "affected"
      },
      {
        "version": "15.0.1.13014-1",
        "status": "affected"
      },
      {
        "version": "15.0.1.13015-1",
        "status": "affected"
      },
      {
        "version": "15.0.1.13016-1",
        "status": "affected"
      },
      {
        "version": "15.0.1.13017-1",
        "status": "affected"
      },
      {
        "version": "15SU3a",
        "status": "affected"
      },
      {
        "version": "14SU5",
        "status": "affected"
      },
      {
        "version": "15SU4",
        "status": "affected"
      },
      {
        "version": "15SU4a",
        "status": "affected"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
sec	www.sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
denizhalil	www.denizhalil.com/2026/06/12/cve-2026-20230-cisco-unified-cm-ssrf/

Parameter	Position	Path	Description	CWE
wsdl	query param	webdialer/Version.jws?wsdl	WebDialer WSDL retrieval used to extract internal hostname for SSRF chain	CWE-918
action	query param	cmplatform/installClusterStatusExecute	SSRF trigger point for cmplatform installation status queries	CWE-918
clusterNodeInstallStatus	query param	cmplatform/installClusterStatusExecute	SSRF trigger point for cmplatform installation status queries	CWE-918
className	path	AdminService	Axis/WSDD related deployment descriptor processing potentially leading to file writes	CWE-918
fileName	path	AdminService	Axis/WSDD related deployment descriptor processing potentially leading to file writes	CWE-918
writeToConsole	path	AdminService	Axis/WSDD related deployment descriptor processing potentially leading to file writes	CWE-918
deployment	path	axis2-web	Axis service processing which can be abused to write deployment descriptors/logs	CWE-918
wsdd	path	axis2-web	Axis service processing which can be abused to write deployment descriptors/logs	CWE-918
java:RPC	path	axis2-web	Axis service processing which can be abused to write deployment descriptors/logs	CWE-918
requestFlow	path	axis2-web	Axis service processing which can be abused to write deployment descriptors/logs	CWE-918

22 Jul 2026 19:10Current

7.6High risk

Vulners AI Score7.6

CVSS 3.18.6

EPSS0.83213

SSVC