CVE-2026-20045

8.2 HIGH 5% exploit odds exploited in the wild Fix listed Injection Network gear

What it is

A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device.  This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root.  Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.

At a glance

Exploitability: Can be exploited over the network without logging in. High risk of data exposure.
In the wild: CISA lists this as exploited in real attacks. Treat as urgent.
Fix: A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

2025-10-08 11:59 UTC ReservedThe CVE id was reserved by its CNA
2026-01-21 Exploited in the wildAdded to CISA's Known Exploited Vulnerabilities list
2026-01-21 17:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2026-02-11 Remediation deadlineCISA's due date for federal agencies to fix it
2026-06-17 10:16 UTC Last updatedMost recent change to the record