Cisco Unified CM SSRF flaw enables root escalation
An unauthenticated SSRF vulnerability in Cisco Unified Communications Manager could let attackers write files to the OS and escalate to root, though exploitation requires WebDialer enabled.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-20230 as exploited in the wild.
Cisco Unified Communications Manager (Unified CM) and its Session Management Edition contain a Server-Side Request Forgery vulnerability tracked as CVE-2026-20230. The flaw is remotely exploitable without authentication and could allow an attacker to write arbitrary files to the underlying operating system. If those files are placed in auto-executed locations, an attacker could gain remote command execution or device access, with a path toward root-level privilege escalation. Exploitation requires the WebDialer service to be enabled, which is not the default configuration, somewhat limiting the exposed attack surface.
No in-the-wild exploitation has been reported, but publicly available proof-of-concept code exists, raising the likelihood of future exploitation attempts. Affected versions include Unified CM/CM SME 14 prior to 14SU and 15 prior to 15SU5 (September 2026) or the relevant COP. Organizations running Unified CM in internet-facing or poorly segmented environments face heightened risk and should prioritize patching, disabling WebDialer where not needed, and applying standard segmentation and least-privilege controls.
Mentioned in this report
Detection guidance
Cisco Unified CM WebDialer SSRF-style Request with Embedded Internal/Loopback URL
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests to the Cisco Unified CM WebDialer service containing embedded URLs pointing to loopback, link-local, or metadata addresses, consistent with SSRF exploitation attempts (CVE-2026-20230). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cisco Unified CM WebDialer SSRF Request Pattern
id: 3bdab0a9-2a9c-54ce-a8b8-611b13ad6653
status: experimental
description: 'Detects HTTP requests to a Cisco Unified CM WebDialer endpoint that
embed a secondary URL
parameter referencing loopback, link-local, or cloud metadata addresses. This pattern
is
consistent with Server-Side Request Forgery (SSRF) exploitation attempts such as
CVE-2026-20230,
which can be used to write arbitrary files to the underlying OS via an unauthenticated
request.
'
references:
- https://sec.cloudapps.cisco.com/security/center/publicationListing.x
author: Vorant
tags:
- attack.t1190
logsource:
category: proxy
product: null
detection:
selection_endpoint:
c-uri|contains: webdialer
selection_ssrf_target:
c-uri|contains:
- 127.0.0.1
- localhost
- 169.254.169.254
- 0.0.0.0
- file://
- '%00'
filter_healthcheck:
c-uri|contains:
- /webdialer/services
cs-method: GET
sc-status: 200
condition: selection_endpoint and selection_ssrf_target and not filter_healthcheck
falsepositives:
- Internal monitoring or health-check scripts probing the WebDialer service with loopback
URLs
- Legitimate click-to-dial integrations that reference internal callback hosts by
IP
level: high
Suspicious Shell/Interpreter Child Process from Cisco Unified CM Web Service
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a shell or scripting interpreter spawned from the Java/Tomcat process backing Cisco Unified CM web services (e.g. WebDialer/CCM), indicating possible post-exploitation command execution after SSRF-driven file write. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shell Spawned from Cisco Unified CM Java Web Service Process
id: 35ed140b-9dc0-5a71-b1ff-557c8d61934c
status: experimental
description: 'Detects command interpreters or shell utilities launched as children
of the Java/Tomcat
process that hosts Cisco Unified CM web services (including WebDialer). Following
successful
exploitation of SSRF-based arbitrary file write vulnerabilities such as CVE-2026-20230,
an
attacker-placed file dropped into an auto-executed location could result in unexpected
shell
or script execution from the web service account.
'
references:
- https://sec.cloudapps.cisco.com/security/center/publicationListing.x
author: Vorant
tags:
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- java
- tomcat
- catalina
selection_child:
Image|endswith:
- /bin/sh
- /bin/bash
- /bin/dash
- /usr/bin/wget
- /usr/bin/curl
- /usr/bin/perl
- /usr/bin/python
condition: selection_parent and selection_child
falsepositives:
- Legitimate administrative scripts or platform maintenance jobs invoked through the
application server
- Vendor-supplied COP/upgrade tooling that shells out from the Java service account
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-cisco-products-could-allow-for-server-side-request-forgery_2026-053
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs