CVE-2026-20230: Cisco Unified Communications Manager SSRF Under Active Exploitation

Vulnerability Overview

CVE-2026-20230 is a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) in Cisco Unified Communications Manager (CUCM). The root cause is insufficient validation of user-supplied URL parameters in the CUCM web interface, allowing the server to be coerced into initiating arbitrary outbound HTTP requests on behalf of the attacker. No authentication is required to trigger the condition.

The impact is broad: a successful exploit can enable internal network reconnaissance behind the firewall, credential harvesting from cloud metadata endpoints (e.g., IMDSv1), and lateral movement to otherwise-isolated internal resources — all without the attacker ever directly touching those systems.

Affected Software

• Vendor: Cisco
• Product: Unified Communications Manager (CUCM)

Specific affected version ranges have not yet been published. Defenders should treat all CUCM deployments as potentially exposed until Cisco releases patch guidance.

Exploitation Status

This vulnerability is listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, confirmed as of its disclosure date of 2026-06-25. KEV listing means active exploitation in the wild has been observed — this is not a theoretical or proof-of-concept risk. Defenders should treat this as a priority: CUCM is commonly deployed in enterprise and government environments, making it a high-value pivot point for threat actors performing internal reconnaissance or attempting to reach segmented networks.

No patch date has been confirmed at time of publication. Apply any available mitigations from Cisco's advisory and restrict external access to the CUCM web interface immediately.

Detection Coverage

The df00tech detection library ships query-ready coverage for CVE-2026-20230 across seven SIEM platforms:

• Microsoft Sentinel (KQL)
• Splunk (SPL)
• Elastic (EQL)
• IBM QRadar (AQL)
• Sumo Logic
• Google Chronicle (YARA-L)
• CrowdStrike (CQL)

At a high level, the detections focus on anomalous outbound HTTP requests originating from the CUCM process or host, particularly those targeting RFC-1918 address ranges, loopback addresses, cloud metadata endpoints (169.254.169.254), or external destinations inconsistent with normal CUCM call-control traffic. Detections also key on request patterns in CUCM web interface logs where attacker-controlled URL parameters appear to redirect server-initiated connections. Tuning guidance is included to reduce false positives from legitimate CUCM federation traffic.

Recommended Action

Apply Cisco's patches as soon as they are available, restrict the CUCM web interface to management VLANs, and block CUCM hosts from initiating arbitrary outbound HTTP at the firewall level. Enable logging on the CUCM web tier if not already active — without it, these detections cannot fire.

Full detection queries, tuning notes, and playbook guidance are available on the CVE-2026-20230 detection page. A purple team package with atomic test cases is available for paid subscribers.