Research · Jan 21, 2026
Critical Code Injection Vulnerability in Cisco Unified Communications Products
A newly discovered code injection vulnerability in Cisco Unified Communications products could allow unauthorized remote command execution, posing significant risks to affected systems.
What changed
Cisco has identified a critical vulnerability in several of its Unified Communications products. This issue arises from inadequate validation of user-supplied input, specifically in HTTP requests, which could enable attackers to execute arbitrary commands on the affected devices.
- The vulnerability affects Cisco Unified Communications Manager (Unified CM).
- Cisco Unified Communications Manager Session Management Edition (Unified CM SME) is also impacted.
- Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) is vulnerable.
- Cisco Unity Connection and Cisco Webex Calling Dedicated Instance are included in the list of affected products.
Who is affected
Organizations utilizing Cisco's Unified Communications products are at risk, especially those that have not implemented the latest security patches. The potential for remote command execution makes this vulnerability particularly concerning.
- Businesses relying on Cisco Unified Communications Manager for their communication needs.
- Organizations using Cisco Webex Calling for remote collaboration.
- Enterprises that have integrated Cisco Unity Connection for voicemail and messaging services.
- Any entity utilizing Cisco Unified Communications Manager Session Management Edition for session handling.
What to do
It is crucial for affected organizations to take immediate action to mitigate the risks associated with this vulnerability. Cisco is expected to release patches and updates to address this issue.
- Monitor Cisco's official channels for updates and patches related to this vulnerability.
- Implement security best practices, including restricting access to affected services.
- Conduct a thorough assessment of your current Cisco Unified Communications deployments.
- Prepare to apply updates as soon as they become available to safeguard your systems.