What We Know
Security researchers and multiple security news sites report that CVE-2026-20230, a high‑severity server‑side request forgery (SSRF) vulnerability in Cisco Unified Communications Manager (Unified CM/CUCM), is being actively exploited in the wild. Reports say the flaw can be triggered by unauthenticated HTTP requests to cause SSRF, perform arbitrary file writes, and enable attackers to drop webshells on vulnerable appliances. Several outlets note attacks began weeks after a patch was released.
Technical disclosure teams and independent researchers published detailed writeups and demonstrations of the full exploit chain. According to the reporting, attackers have used the vulnerability to write files that lead to remote code execution and, in at least theoretical demonstrations, could escalate to root‑level access. The activity was described both as active exploitation in the wild and as a same‑day/full‑chain RCE sweep in technical analysis, and vendors and security sites have urged affected customers to address the issue.
Source Comparison
Aligned reportingCorroborates
- BleepingComputer↗Confirms CVE-2026-20230 is a high-severity SSRF in Cisco Unified CM now being exploited, and notes it can be triggered by unauthenticated HTTP requests that enable SSRF, arbitrary file writes, and webshell deployment.
- helpnetsecurity.com↗Reports the flaw is actively exploited to drop webshells on vulnerable Cisco Unified CM appliances, supporting the briefing's claim that arbitrary file writes have been used to deploy webshells.
- networkworld.com↗States attackers began exploiting the SSRF bug weeks after Cisco released a patch and notes the vulnerability can allow unauthenticated file writes and potential root-level access, matching the timeline and impact in the briefing.
- csoonline.com↗Notes active exploitation weeks after the patch release and that the SSRF vulnerability can permit unauthenticated file writes and possible root access, corroborating the briefing's technical impact and timing.
- securityweek.com↗Confirms that attackers are exploiting Cisco Unified CM CVE-2026-20230 in the wild and underscores the urgency for remediation, aligning with reports of active exploitation and recommended fixes.
- securityaffairs.com↗Describes attackers exploiting CVE-2026-20230 via unauthenticated HTTP requests to trigger SSRF, write files, and drop webshells, matching the briefing's description of attack technique and effects.
- ssd-disclosure.com↗SSD Secure Disclosure's technical publication documents an arbitrary file write to RCE chain on Cisco Unified Communications Manager, corroborating that detailed writeups and exploit demonstrations were published.
- defusedcyber.com↗Presents a same-day, full-chain RCE sweep against CUCM (CVE-2026-20230), demonstrating remote code execution from the SSRF and supporting the briefing's account of full-chain technical research and demonstrations.