CVE-2026-20045

Published Jan 21, 2026

Last updated 5 months ago

Exploit known CVSS high 8.2

Unified CM

Cloud

HTTP

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-20045 is a vulnerability found in several Cisco Unified Communications products, including Cisco Unified Communications Manager (Unified CM), Unified Communications Manager Session Management Edition (Unified CM SME), Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance. This flaw stems from improper validation of user-supplied input within HTTP requests. An attacker can exploit this vulnerability by sending a sequence of specially crafted HTTP requests to the web-based management interface of an affected device. Successful exploitation could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system and subsequently elevate privileges to root.

Description: A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device.  This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root.  Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.
Source: psirt@cisco.com
NVD status: Analyzed
Products: unified_communications_manager, unified_communications_manager_im_and_presence_service, unity_connection

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Cisco Unified Communications Products Code Injection Vulnerability
Exploit added on: Jan 21, 2026
Exploit action due: Feb 11, 2026
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

psirt@cisco.com: CWE-94

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:-:*:*:*",
            "matchCriteriaId": "9A84A37B-553F-48B5-8F92-678A478EE896",
            "versionEndExcluding": "14su5",
            "versionStartIncluding": "12.5",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:session_management:*:*:*",
            "matchCriteriaId": "27BC4E6E-8C4D-4EEA-A8DB-8CBC11349336",
            "versionEndExcluding": "14su5",
            "versionStartIncluding": "12.5",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:-:*:*:*",
            "matchCriteriaId": "E8EE2A11-29DC-45EF-A9B0-E053C004EF82",
            "versionEndIncluding": "15su3a",
            "versionStartIncluding": "15.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cisco:unified_communications_manager:*:*:*:*:session_management:*:*:*",
            "matchCriteriaId": "99E5929A-E9DE-4370-A363-66BDA1D46BDE",
            "versionEndIncluding": "15su3a",
            "versionStartIncluding": "15.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "1235D0E6-5703-4DAB-8D50-0DBEF7A9A1EB",
            "versionEndExcluding": "14su5",
            "versionStartIncluding": "12.5",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cisco:unified_communications_manager_im_and_presence_service:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "EF732C27-6F22-4987-BCED-B7303E8F9789",
            "versionEndIncluding": "15su3a",
            "versionStartIncluding": "15.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cisco:unity_connection:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "8CD37F03-3690-4C47-9768-06EB00F693AB",
            "versionEndExcluding": "14su5",
            "versionStartIncluding": "12.5",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:cisco:unity_connection:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "FD7BF042-4261-4F93-913D-D7B756F975CD",
            "versionEndIncluding": "15su3",
            "versionStartIncluding": "15.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.