Cisco Unified Communications Manager SSRF vulnerability
Cisco Unified Communications Manager has a server-side request forgery vulnerability (CVE-2026-20230) affecting versions 14 and 15.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-20230 as exploited in the wild.
The French CERT (ANSSI) has disclosed a server-side request forgery (SSRF) vulnerability affecting multiple versions of Cisco Unified Communications Manager and Unified Communications Manager Session Management Edition. The vulnerability impacts version 14 releases prior to 14SU6 and version 15 releases prior to 15SU5 or COP1 for both product lines.
SSRF vulnerabilities allow attackers to abuse the trust relationship between a vulnerable server and other systems, potentially enabling unauthorized access to internal resources, data exfiltration, or reconnaissance of internal network architecture. The vulnerability is tracked as CVE-2026-20230.
Cisco has published a security advisory with remediation guidance. Organizations should consult the vendor bulletin and apply patches according to their deployment schedule. Version 15SU5 is expected to be available in September 2026.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0689
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs