Cisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to Root

Security professionals are on high alert as threat actors have begun actively exploiting a critical vulnerability in Cisco's Unified Communications Manager products. The situation has escalated following the release of proof-of-concept code that demonstrates how attackers can leverage this flaw to gain root access to affected systems, putting enterprise communications infrastructure at significant risk.

The vulnerability, designated CVE-2026-20230 with a CVSS score of 8.6, stems from improper input validation in specific HTTP requests within Cisco Unified CM and Unified CM Session Management Edition. This security weakness allows unauthenticated remote attackers to execute malicious operations without requiring any credentials. The release of working exploit code has significantly lowered the barrier for threat actors, prompting immediate action from security teams worldwide.

Organizations utilizing Cisco Unified CM and Unified CM SME platforms are directly exposed to this threat. These products form the backbone of many enterprise telephony and communications systems, meaning a successful compromise could disrupt critical business operations and potentially expose sensitive communications