Skip to content
Fencer Intel
high 8.2

CVE-2026-20045 kev in the critical feed json

Cisco Unified Communications Products Remote Code Execution Vulnerability

published 9mo ago modified 4mo ago also EUVD-2026-3600

cvss
8.2
version 3.1, CNA
cisa kev
Exploited
added 2026-01-21
epss
4.5%
EPSS 4.5% chance of exploitation in 30 days, percentile 91%
public exploits
0
none known

Summary

A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. 

This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root.  Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.

Patch / fix

cisa required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  • cisco unified_communications_manager 14su5
  • cisco unified_communications_manager_im_and_presence_service 14su5
  • cisco unity_connection 14su5

Is CVE-2026-20045 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Timeline

  1. Added to CISA KEV
  2. Published
  3. CISA SSVC: exploitation active
  4. CISA patch deadline

Known exploited

Added
9mo ago
Patch by
2026-02-11 (8mo ago)
Ransomware
Not known
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Vendor, product
Cisco, Unified Communications Manager
CISA name
Cisco Unified Communications Products Code Injection Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
yes
Technical impact
total
Assessed
9mo ago

Exploit prediction

4.54% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Cisco Cisco Unified Communications Manager
  • Cisco Cisco Unified Communications Manager IM and Presence Service
  • Cisco Cisco Unity Connection

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.