ZeroDay Findings
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-20045

Cisco Unified Communications Products Code Injection Vulnerability

Published Jan 21, 2026 · catalog updated Jun 17, 2026 · Cisco Unified Communications Manager

Patch now

CVE-2026-20045 is in the CISA known-exploited catalog, due Feb 11, 2026. Confirm Cisco Unified Communications Manager against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Severity
Critical9.8
Known exploitation
CISA KEV and VulnCheck KEV
EPSS
4.54%
Remediation
Remediation guidance
Affected products
cpe cisco/unified communications manager · cpe cisco/unified communications manager im and presence service · cpe cisco/unity connection · vendor Cisco Unified Communications Manager

A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • cpe cisco/unified communications managerversion unspecified
  • cpe cisco/unified communications manager im and presence serviceversion unspecified
  • cpe cisco/unity connectionversion unspecified
  • vendor Cisco Unified Communications Managerversion unspecified

How to fix CVE-2026-20045

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

CVE-2026-20045 is in the CISA known-exploited catalog, due Feb 11, 2026. Confirm Cisco Unified Communications Manager against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Which versions are affected?

Affected version ranges are not on this record. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

What should an analyst verify?

CWE-94: Code Injection. EPSS 4.54%. The CISA KEV listing is the exploitation evidence. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Cisco security

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Jan 21, 2026 · Catalog

    Detected

    A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operati

  2. Jan 21, 2026 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  3. Feb 11, 2026 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  4. Jun 17, 2026 · Catalog

    Updated

    A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operati

Sources

  • CISA KEVConfirmed exploitationCVE-2026-20045

    Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance contain a code injection vulnerability that could allow the attacker to obtain user-level access to the underlying operati

    cisa.gov
  • CVE.orgVulnerability recordCVE-2026-20045

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-20045

    30-day exploitation probability 4.5%

    first.org
  • NIST NVDVulnerability recordCVE-2026-20045

    A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Ca

    nvd.nist.gov
  • VulnCheck KEVConfirmed exploitationCVE-2026-20045

    Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance co

    vulncheck.com

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.