{"id":"CVE-2026-20045","kind":"vulnerability","aliases":["CVE-2026-20045"],"related":[],"title":"A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session…","description":"A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device.&nbsp;\r\n\r\nThis vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root.&nbsp;\r\nNote: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.","summary":"Cisco Unified Communications Manager, Unity Connection and related Cisco voice products contain a code injection flaw. An attacker can get user-level shell access on the underlying operating system and then escalate to root.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-01-21T00:00:00+00:00","products":[{"name":"cisco unified communications manager","fixed":["14su5"],"affected":">= 12.5, < 14su5","ecosystem":"vendor"},{"name":"cisco unified communications manager","fixed":[],"affected":">= 15.0, <= 15su3a","ecosystem":"vendor"},{"name":"cisco unified communications manager im and presence service","fixed":["14su5"],"affected":">= 12.5, < 14su5","ecosystem":"vendor"},{"name":"cisco unified communications manager im and presence service","fixed":[],"affected":">= 15.0, <= 15su3a","ecosystem":"vendor"},{"name":"cisco unity connection","fixed":["14su5"],"affected":">= 12.5, < 14su5","ecosystem":"vendor"},{"name":"cisco unity connection","fixed":[],"affected":">= 15.0, <= 15su3","ecosystem":"vendor"},{"name":"Cisco Unified Communications Manager","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cisco-unified-cm","cisco-unity-connection","exploited","infrastructure","on-prem-voice","webex-calling-dedicated-instance"],"not_affected_if":["cisco-cloud-only-webex"],"how_to_check":"Confirm which Cisco Unified CM, CM SME, IM&P, Unity Connection or Webex Calling Dedicated Instance versions you run, using the product admin interface.","fix":"Apply the Cisco mitigation or fixed release from the Cisco security advisory for CVE-2026-20045; the sources do not name the version.\nIf no mitigation is available, follow CISA guidance and discontinue use of the product.","status":"open","published_at":"2026-01-21T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:42:36+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:42:36Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Cisco mitigation or fixed release from the Cisco security advisory for CVE-2026-20045; the sources do not name the version.\nIf no mitigation is available, follow CISA guidance and discontinue use of the product.","reach":"unknown","summary":"Cisco Unified Communications Manager, Unity Connection and related Cisco voice products contain a code injection flaw. An attacker can get user-level shell access on the underlying operating system and then escalate to root.","category":"infrastructure","who_cares":["cisco-unified-cm","cisco-unity-connection","on-prem-voice","webex-calling-dedicated-instance"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs commands as user, then escalates to root on the server","analyst_note":"Find the Cisco advisory for CVE-2026-20045 to get affected and fixed versions, the attack vector, and any required privileges or configuration.","how_to_check":"Confirm which Cisco Unified CM, CM SME, IM&P, Unity Connection or Webex Calling Dedicated Instance versions you run, using the product admin interface.\nunknown","needs_analyst":true,"not_affected_if":["cisco-cloud-only-webex"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000499,"input_tokens":2645,"output_tokens":468,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-20045':17A,20A '-2026':16A,19A 'access':98B,219C 'advisori':237C 'affect':165C,205C 'allow':149C,211C 'and':34A,42A 'arbitrari':156C 'assign':234C 'attack':91B,153C,183C,213C,264C 'base':200C 'call':71B,145C 'cisco':4A,10A,21A,25A,29A,37A,45A,48A,51A,56B,60B,74B,82B,112C,118C,128C,139C,143C,232C 'cisco-unified-cm':55B 'cisco-unity-connect':59B 'cm':9A,58B,117C,126C,136C 'code':87B 'command':157C 'communic':6A,12A,76B,114C,120C,130C 'communications':23A,27A,31A,39A,53A 'connect':62B,79B,141C 'connection':47A,50A 'contain':85B 'could':148C,184C,210C,260C 'craft':193C 'critic':244C 'cve':15A,18A 'dedic':72B,146C 'devic':166C,206C 'due':170C 'edit':124C 'elev':227C,265C 'escal':106B 'execut':155C 'exploit':63B,185C,209C,256C 'flaw':89B 'get':93B 'high':247C 'http':180C,194C 'im':33A,41A,132C,137C 'impact':240C 'improp':172C 'indic':251C 'infrastructur':64B 'inject':88B 'input':178C 'instanc':73B,147C 'interfac':202C 'level':96B,218C 'manag':7A,13A,77B,115C,121C,123C,131C,201C 'manager':24A,28A,32A,40A,54A 'note':231C 'obtain':215C 'on-prem-voic':65B 'oper':102B,161C,223C 'p':138C 'prem':67B 'presenc':133C 'presence':35A,43A 'privileg':228C,266C 'product':84B 'rate':241C 'rather':245C 'reason':253C 'relat':81B 'remot':152C 'request':181C,195C 'result':261C 'root':108B,230C,268C 'score':250C 'secur':236C,239C 'send':189C 'sequenc':191C 'servic':134C 'service':36A,44A 'session':14A,122C 'shell':97B 'sir':242C 'sme':127C 'success':208C 'suppli':177C 'system':103B,162C,224C 'unauthent':151C 'under':101B,160C,222C 'unifi':5A,8A,11A,57B,75B,113C,116C,119C,125C,129C,135C 'unified':22A,26A,30A,38A,52A 'uniti':61B,78B,140C 'unity':46A,49A 'user':95B,176C,217C 'user-level':94B,216C 'user-suppli':175C 'valid':173C 'voic':68B,83B 'vulner':2A,110C,168C,187C,259C 'web':199C 'web-bas':198C 'webex':70B,144C 'webex-calling-dedicated-inst':69B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-01-21T00:00:00+00:00","kev":{"dateAdded":"2026-01-21","dueDate":"2026-02-11","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-20045","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-20045","severity":null,"published_at":"2026-01-21T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T20:35:31+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-20045","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20045","severity":null,"published_at":"2026-01-21T17:16:08+00:00","modified_at":"2026-06-17T10:16:58+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}