Vulnerability record · CVE-2026-20045 · published 21 January 2026
CVE-2026-20045: Cisco Unified Communications products HTTP input code injection RCE
Cisco · Unified Communications Manager
Cisco Unified CM, Unified CM SME, IM & Presence, Unity Connection, and Webex Calling Dedicated Instance fail to properly validate user-supplied input in HTTP requests to the web-based management interface. An unauthenticated remote attacker can send crafted HTTP requests to execute arbitrary commands on the underlying OS. Cisco rates this Critical because successful exploitation leads to root, and CISA added it to KEV on the publication date.
Description
A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityUnauthenticated remote code execution reaching root on widely deployed communications infrastructure, with CISA KEV listing indicating known exploitation.
What it is
Cisco Unified CM, Unified CM SME, IM & Presence, Unity Connection, and Webex Calling Dedicated Instance fail to properly validate user-supplied input in HTTP requests to the web-based management interface. An unauthenticated remote attacker can send crafted HTTP requests to execute arbitrary commands on the underlying OS. Cisco rates this Critical because successful exploitation leads to root, and CISA added it to KEV on the publication date.
Impact
An attacker gains user-level access to the underlying operating system and can escalate to root, giving full control of the affected communications appliance.
Attack surface
Reachable over the network through the web-based management interface via crafted HTTP requests; the CVSS vector shows no privileges or user interaction required.
Exploitation
Listed in CISA KEV with a 2026-02-11 remediation due date, indicating known exploitation; EPSS 30-day probability is 0.04478 (90.9th percentile). No ransomware campaign use is documented.
What to do
- Apply the Cisco security advisory (cisco-sa-voice-rce-mORhqY4b) fixes for all affected products, prioritizing internet-facing management interfaces.
- If patching is not immediately possible, follow Cisco's advisory workarounds and CISA BOD 22-01 guidance, or discontinue use of the product where mitigations are unavailable.
- Restrict access to the web-based management interface to trusted management networks and block it from the public internet.
- Monitor Cisco advisory updates and the KEV entry for revised affected-product or mitigation details.
Detection
- Review web management interface access logs for unusual or malformed HTTP request sequences, especially from untrusted sources.
- Alert on unexpected process creation or command execution on Unified CM, Unity Connection, and IM & Presence hosts.
- Monitor for privilege escalation to root or anomalous OS-level activity on these appliances.
- Hunt for management interface exposure to the internet across the affected product set.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2026-20045 to the Known Exploited Vulnerabilities catalog on 21 January 2026 as "Cisco Unified Communications Products Code Injection Vulnerability". Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 11 February 2026.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-rce-mORhqY4b | Vendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20045 | US Government Resource |
Track CVE-2026-20045 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2026-20045), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
