2026 Cisco Unified CM — CVE-2026-20230 SSRF actively exploited (Jun–Jul)
Data compromised
Platform vulnerability exploitation enabling arbitrary file write and potential RCE on Unified CM appliances—not a confirmed Cisco corporate data exfiltration event
Technical writeup
Cisco confirmed July 2, 2026 that attackers are actively exploiting CVE-2026-20230 in Unified Communications Manager (Unified CM), a critical SSRF vulnerability patched June 3, 2026. Defused reported in-the-wild exploitation beginning June 22 using crafted file:// payloads to create files on targeted devices; SSD Secure published a proof-of-concept explaining arbitrary file write to RCE. This is a product exploitation campaign affecting customer telephony infrastructure, distinct from Cisco's separate ShinyHunters CRM extortion claim (cisco2026). BreachHistory indexes recordsAffected 0 because no attested victim PII volume is tied to Cisco corporate systems; enterprise Unified CM operators should patch immediately.
Root cause
Active exploitation of CVE-2026-20230, a critical Unified Communications Manager SSRF/arbitrary file-write flaw patched June 3, 2026; Defused observed in-the-wild attacks June 22 using crafted file:// payloads
References
- https://www.bleepingcomputer.com/news/security/cisco-finally-confirms-attackers-exploiting-unified-cm-flaw/
- https://www.bleepingcomputer.com/news/security/cisco-unified-cm-sme-flaw-cve-2026-20230-now-exploited-in-attacks/
- https://www.bleepingcomputer.com/news/security/cisco-warns-of-critical-unified-cm-flaw-with-poc-exploit-code/
- https://ssd-disclosure.com/cisco-unified-communications-manager-arbitrary-file-write-to-rce/