RCE in Cisco Unified Communications Manager
CVE-2026-20045
A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.044 (90.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N.
Affected products
- Cisco Unified Communications Manager — versions 12.5(1)SU2, 12.5(1)SU1, 12.5(1)
- Cisco Unified Communications Manager Im And Presence Service — versions 12.5(1), 12.5(1)SU1, 12.5(1)SU2
- Cisco Unity Connection — versions 12.5(1), 12.5(1)SU1, 12.5(1)SU2
- Cisco Unified_communications_manager
- Cisco Unified_communications_manager_im_and_presence_service
- Cisco Unity_connection
Weakness classification (CWE)
CISA KEV (Known Exploited Vulnerabilities)
This CVE is on the CISA KEV catalog, added on . CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.
BOD 22-01 due date: .
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Public proof-of-concept exploits
References
- psirt@cisco.com (Vendor Advisory)
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (US Government Resource)
Frequently asked questions
- What is CVE-2026-20045?
- CVE-2026-20045 is a high-severity vulnerability in Cisco Unified Communications Manager, classified under Code Injection. CVSS score: 8.2/10. Published 2026-01-21.
- How severe is CVE-2026-20045?
- High severity. CVSS v3 base score is 8.2 out of 10.
- Is CVE-2026-20045 known to be exploited?
- Yes. CVE-2026-20045 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2026-01-21), indicating it is being actively exploited. 1 public proof-of-concept repositories are indexed.