Cisco has released patches for CVE-2026-20230, a server-side request forgery vulnerability in Unified Communications Manager that allows unauthenticated attackers to write files and escalate privileges to root. While Cisco's PSIRT reports no active exploitation yet, proof-of-concept code is now publicly available, significantly increasing the risk of imminent attacks.
Cisco has patched a bug in Unified Communications Manager that lets an unauthenticated attacker on the network write files to the box and, from there, climb to root. It is tracked as CVE-2026-20230, and proof-of-concept exploit code is already public. Cisco's PSIRT says it has not seen the flaw used in attacks yet. The PoC shortens that runway. The flaw is a server-side request forgery.
Originally published at thehackernews.com
60-minute technical evaluation, no obligation. We'll map the ideas in this article to your environment.
1 min read
1 min read
1 min read