DMZ//THREAT INTEL
FEED ACTIVELAST SYNC: 05:01:53ZSOURCES: 14CRITICAL: 26
⚠ ACTIVE ALERTS
UAC-0145 (Sandworm) CRITICAL — UAC-0145 is a confirmed sub-cluster of Sandworm, Russia's GRU-affiliated advanced hacking… /// CYLINDRICALCANINE CRITICAL — CylindricalCanine is a newly named operational subgroup within the China-linked… /// @CrowdStrike CRITICAL — July 2026 Patch Tuesday analysis: CVE-2026-56155 (AD FS EoP, CVSS 7.8) confirmed… /// @MsftSecIntel CRITICAL — Microsoft has confirmed active exploitation of CVE-2026-56155 in Active Directory… /// @GossiTheDog CRITICAL — CVE-2026-56155 ADFS zero-day is nastier than the CVSS 7.8 suggests. Admin on your ADFS…
26Critical Threats
18Active CVEs
10IOCs Tracked
5New Advisories
INTEL FEED/ADVISORIES/cisco-sa-cucm-ssrf-cXPnHcW
TLP:WHITE
Disclosure not limited. This advisory may be distributed publicly through any channel.
OFFICIAL ADVISORY // cisco-sa-cucm-ssrf-cXPnHcW // PUBLISHED 2026-06-25
CiscoCVE-2026-20230

Cisco Unified Communications Manager SSRF to Root – CVE-2026-20230 (Actively Exploited, CISA KEV)

ADVISORY SUMMARY

A critical-rated (CVSS 8.6, vendor-escalated to Critical SIR) server-side request forgery vulnerability in Cisco Unified CM and Unified CM SME allows unauthenticated remote attackers to write arbitrary files to the underlying OS and escalate to root via the WebDialer component. Public PoC exploit code emerged within 24 hours of June 3 disclosure, active exploitation was confirmed by June 22–23 with attackers deploying multi-stage JSP web shells, and CISA added it to KEV on June 25 with a 3-day remediation deadline for federal agencies. The attack chain is fully automated, uses Tor for obfuscation, and targets enterprise telephony infrastructure across healthcare, government, and financial sectors.

AFFECTED SYSTEMS

AFFECTED SYSTEM
SEVERITY
EXPLOIT
PATCH
Cisco Unified Communications Manager (Unified CM) – versions prior to 14SU6 and 15SU5 with WebDialer enabled
HIGH
PUBLIC
PATCHED
Cisco Unified Communications Manager Session Management Edition (Unified CM SME) – same affected release trains
HIGH
PUBLIC
PATCHED

MITIGATION GUIDANCE

Upgrade Unified CM to release 14SU6 (version 14) or 15SU5 (version 15) per Cisco advisory cisco-sa-cucm-ssrf-cXPnHcW. If WebDialer is not operationally required, disable it immediately in Cisco Unified Serviceability > Control Center – Feature Services > CTI Services section. Restrict management interface (port 8443) access to trusted networks. Audit /platform-services/axis2-web/ for unauthorized .jsp web shell files.

DETECTION SIGNATURES

Monitor HTTP requests to /cmplatform/installClusterStatusExecute with path traversal sequences (../) in hostname parameters. Alert on anomalous requests to /webdialer/Version.jws?wsdl (reconnaissance phase). Detect new or unexpected .jsw/.wsdd files in Axis2 web directories. Log and alert on pwd=123 parameter in web requests (Stage-2 web shell indicator). Block known Tor exit node IPs at perimeter. Hunt for unexpected file writes to /tmp/ and /platform-services/axis2-web/ directories.

INDICATORS OF COMPROMISE

⚿
EXPORT FORMATTED IOC PACKAGE
Splunk SPL · KQL · Sigma rules · Firewall blocklists — subscriber feature
SUBSCRIBE →
#
TYPE
INDICATOR
CONTEXT
FIRST SEEN
001
HASH
sppb660-batch/1.0
Stage-1 JSP Web Shell Pattern
2026-06-25
002
DOMAIN
webdialer/Version.jws?wsdl
Recon Endpoint
2026-06-25

REFERENCES

  • → https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW
  • → https://www.bleepingcomputer.com/news/security/cisco-unified-cm-sme-flaw-cve-2026-20230-now-exploited-in-attacks/
  • → https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  • → https://nvd.nist.gov/vuln/detail/CVE-2026-20230
  • → https://horizon3.ai/attack-research/vulnerabilities/cve-2026-20230/
SHARE BRIEF:✕ Post on Xin Share on LinkedIn