# Cisco Unified Communications RCE exploited in wild

Published: 2026-01-21 · Severity: high · Sectors: telecommunications, government-national
Canonical: https://vorant.io/reports/4a8948ff-513c-523e-a1f3-9ff3a44cca73/cisco-unified-communications-rce-exploited-in-wild

> Unauthenticated remote code execution in Cisco UC products is under active exploitation; patch immediately.

Cisco has disclosed CVE-2026-20045, a critical vulnerability in Cisco Unified Communications Products that allows unauthenticated remote attackers to execute arbitrary commands as root on affected devices. The flaw stems from improper validation of user-supplied input in HTTP requests to the web-based management interface. An attacker can send a sequence of crafted HTTP requests to gain user-level access and then escalate privileges to root, resulting in complete device compromise. Cisco PSIRT confirms this vulnerability is actively exploited in the wild.

Affected products include Unified CM, Unified CM SME, Unified CM IM&P, Unity Connection, and Webex Calling Dedicated Instance. Cisco strongly recommends immediate patching. The attack requires no authentication and exploits a public-facing application interface, making it accessible to remote attackers without requiring user interaction or valid credentials.

## Mentioned in this report

- Vulnerabilities: CVE-2026-20045 (KEV)

## Detection guidance (public sample)

### Command Injection Patterns in Web Management Interface Request Query

ATT&CK: T1190

Web server log entries whose query string carries shell paths, command substitution or chained download-tool commands, consistent with input-validation RCE against public-facing management portals such as Cisco UC. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Command Injection Patterns in Web Management Interface Request Query
description: Detects HTTP requests whose query string contains shell interpreters,
  command substitution or chained download utilities. Generic behavioural pattern
  for unauthenticated command injection against public-facing management interfaces
  (e.g. Cisco Unified Communications CVE-2026-20045). Tune by scoping to the management-interface
  virtual host or source network.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_shell:
    cs-uri-query|contains:
    - /bin/sh
    - /bin/bash
    - '%2fbin%2fsh'
    - '%2fbin%2fbash'
    - ${IFS}
    - $(curl
    - $(wget
    - '%24%28curl'
    - '%24%28wget'
  selection_chain:
    cs-uri-query|contains:
    - ;curl
    - ;wget
    - '|curl'
    - '|wget'
    - '%3bcurl'
    - '%3bwget'
    - '%7ccurl'
    - '%7cwget'
  condition: 1 of selection_*
falsepositives:
- Vulnerability scanners and authorised penetration tests against the management interface
- Web applications that legitimately pass shell-like strings in parameters (e.g. documentation
  or wiki portals)
level: medium
id: 8953aed5-d57e-5730-8926-35631c858a25
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-cisco-unified-communications-products-could-allow-for-remote-code-execution_2026-006
```

### Java Web Service Spawning Shell With Download or Reverse Shell Commands

ATT&CK: T1190

A Java application server process spawning a shell that runs download, reverse-shell or payload staging commands, indicating post-exploitation of a web RCE on a Linux appliance or server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Java Web Service Spawning Shell With Download or Reverse Shell Commands
description: Detects a Java process (e.g. Tomcat-based management web interface) spawning
  sh/bash with commands for payload download, staging or reverse shells. Post-exploitation
  behaviour following command-injection RCE in public-facing Java web applications
  such as Cisco Unified Communications products. Requires process telemetry on the
  Linux host.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: /java
    Image|endswith:
    - /sh
    - /bash
    CommandLine|contains:
    - curl
    - wget
    - /dev/tcp/
    - 'nc '
    - 'ncat '
    - base64 -d
    - chmod +x
    - chmod 777
  condition: selection
falsepositives:
- Java-based deployment or build tooling (e.g. Jenkins agents) running curl/wget in
  shell steps
- Application health-check scripts launched from a Java service
level: medium
id: 3fcecb08-d9a9-5b10-941a-b3f811eb0b90
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-cisco-unified-communications-products-could-allow-for-remote-code-execution_2026-006
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-cisco-unified-communications-products-could-allow-for-remote-code-execution_2026-006

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/4a8948ff-513c-523e-a1f3-9ff3a44cca73/cisco-unified-communications-rce-exploited-in-wild.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup