CVE-2026-20045: Cisco Unified Communications Manager Code Injection

let CUCMHosts = dynamic(["cucm", "callmanager", "ucm"]);
let SuspiciousPatterns = dynamic(["cmd.exe", "powershell", "bash", "sh", "/bin/sh", "wget", "curl", "python", "perl"]);
union DeviceEvents, DeviceProcessEvents, CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DeviceName has_any (CUCMHosts) or DestinationHostName has_any (CUCMHosts) or Computer has_any (CUCMHosts)
| where (EventType == "ProcessCreated" and (ProcessCommandLine has_any (SuspiciousPatterns) or InitiatingProcessFileName in~ ("java", "tomcat")))
   or (Activity has "POST" and RequestURL has_any ("/ccmadmin", "/ccmservice", "/cucm-uds") and RequestBodyLength > 500)
   or (SourceIP !in ("127.0.0.1", "::1") and Activity has "200" and RequestURL has_any ("/axl/", "/realtimeservice2"))
| extend RiskScore = case(
    ProcessCommandLine has_any ("wget", "curl") and ProcessCommandLine has "http", 90,
    ProcessCommandLine has_any ("bash", "sh") and InitiatingProcessFileName has "java", 85,
    RequestBodyLength > 5000, 70,
    50)
| where RiskScore >= 50
| project TimeGenerated, Computer, DeviceName, ProcessCommandLine, InitiatingProcessFileName, RequestURL, SourceIP, DestinationIP, RiskScore
| sort by RiskScore desc

index=* (sourcetype=cisco:ucm OR sourcetype=cisco:cucm OR sourcetype=syslog host=*cucm* OR host=*callmanager*)
| eval is_suspicious_proc=if(match(process, "(?i)(cmd\.exe|powershell|/bin/sh|/bin/bash|wget|curl|python|perl|nc |netcat)"), 1, 0)
| eval is_suspicious_http=if(match(uri, "(?i)(/ccmadmin|/ccmservice|/cucm-uds|/axl/|/realtimeservice2)") AND (method="POST" OR method="PUT"), 1, 0)
| eval is_java_spawn=if(match(parent_process, "(?i)(java|tomcat|catalina)") AND match(process, "(?i)(sh|bash|cmd|python|perl)"), 1, 0)
| where is_suspicious_proc=1 OR is_suspicious_http=1 OR is_java_spawn=1
| eval risk_score=case(
    is_java_spawn=1 AND is_suspicious_proc=1, 95,
    is_java_spawn=1, 80,
    is_suspicious_proc=1, 70,
    is_suspicious_http=1, 60,
    true(), 50)
| eval alert_reason=case(
    is_java_spawn=1, "Java/Tomcat spawned shell process - likely RCE",
    is_suspicious_proc=1, "Suspicious process execution on CUCM host",
    is_suspicious_http=1, "Anomalous POST to CUCM admin endpoint",
    true(), "Unknown")
| where risk_score >= 60
| table _time, host, src_ip, dest_ip, uri, method, process, parent_process, user, risk_score, alert_reason
| sort - risk_score

sequence by host.name with maxspan=5m
  [process where event.type == "start"
   and process.parent.name in ("java", "catalina.sh", "tomcat")
   and process.name in ("sh", "bash", "python", "python3", "perl", "wget", "curl", "nc")]
  [any where
   (event.category == "network" and network.direction == "egress" and
    not destination.ip in ("127.0.0.1", "::1") and destination.port in (80, 443, 4444, 8080, 8443, 9001))
   or
   (event.category == "file" and file.path like~ "/opt/cisco/*" and event.action in ("creation", "overwrite"))]

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') as event_time,
  sourceip,
  destinationip,
  destinationport,
  username,
  URL,
  'Process Name' as process_name,
  'Command' as command_line,
  magnitude,
  QIDNAME(qid) as event_name
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Cisco Unified Communications Manager', 'Linux OS', 'Syslog')
  AND (
    (URL MATCHES '(?i)(/ccmadmin|/ccmservice|/cucm-uds|/axl/)'
     AND 'Request Method' = 'POST'
     AND 'Request Size' > 500)
    OR
    ("Process Name" MATCHES '(?i)(bash|sh|python|perl|wget|curl|nc)'
     AND "Parent Process" MATCHES '(?i)(java|tomcat|catalina)')
    OR
    (magnitude >= 7 AND LOGSOURCENAME(logsourceid) MATCHES '(?i)(cucm|callmanager|ucm)')
  )
  AND LAST 7 DAYS
ORDER BY magnitude DESC, event_time DESC

_sourceCategory=cisco/ucm OR _sourceCategory=cisco/callmanager OR _collector=cucm*
| parse "method=*" as method nodrop
| parse "uri=*" as uri nodrop
| parse "src_ip=*" as src_ip nodrop
| parse "process=*" as process nodrop
| parse "parent_process=*" as parent_process nodrop
| where (
    (uri matches "*ccmadmin*" OR uri matches "*ccmservice*" OR uri matches "*axl*" OR uri matches "*cucm-uds*")
    AND method = "POST"
  )
  OR (
    parent_process matches "*java*" OR parent_process matches "*tomcat*"
    AND (process matches "*bash*" OR process matches "*sh*" OR process matches "*python*" OR process matches "*curl*" OR process matches "*wget*")
  )
| eval risk = if(parent_process matches "*java*" AND (process matches "*bash*" OR process matches "*sh*"), "CRITICAL",
             if(uri matches "*axl*" AND method = "POST", "HIGH", "MEDIUM"))
| count by _sourceHost, src_ip, uri, process, parent_process, risk
| where _count > 0
| sort by risk, _count desc

rule cve_2026_20045_cisco_ucm_code_injection {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2026-20045 exploitation in Cisco Unified Communications Manager"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-rce-mORhqY4b"

  events:
    (
      // Detect shell spawn from Java/Tomcat parent
      $e1.metadata.event_type = "PROCESS_LAUNCH"
      and (
        re.regex($e1.principal.process.file.full_path, `(?i)(java|tomcat|catalina)`)
        or re.regex($e1.principal.process.command_line, `(?i)(catalina|tomcat)`)
      )
      and re.regex($e1.target.process.file.full_path, `(?i)(/bin/sh|/bin/bash|python|perl|wget|curl)`)
    )
    or
    (
      // Detect anomalous POST to admin endpoints
      $e1.metadata.event_type = "NETWORK_HTTP"
      and $e1.network.http.method = "POST"
      and re.regex($e1.target.url, `(?i)(/ccmadmin|/ccmservice|/axl/|/cucm-uds|/realtimeservice2)`)
      and $e1.network.sent_bytes > 500
      and not net.ip_in_range_cidr($e1.principal.ip, "127.0.0.0/8")
    )

  condition:
    $e1
}

#event_simpleName=ProcessRollup2
| ImageFileName=/(?i)(java|catalina|tomcat)/
| CommandLine=/(?i)(bash|\bsh\b|\/bin\/sh|python[23]?|perl|wget|curl|nc\b|ncat|netcat)/
| event_platform=Lin
| eval risk_label="Java/Tomcat spawned suspicious child process"
| groupBy([aid, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName], function=count(aid, as=event_count))
| join type=left
  [
    #event_simpleName=NetworkConnectIP4
    | RemotePort in [80, 443, 4444, 8080, 8443, 1337, 9001]
    | not RemoteAddressIP4=/^(127\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01]))\./, groupBy([aid], function=collect([RemoteAddressIP4, RemotePort]))
  ]
  on aid
| sort event_count desc
| select ComputerName, UserName, ImageFileName, CommandLine, RemoteAddressIP4, RemotePort, event_count, risk_label