Cisco Unified CM SSRF Flaw Enables Root Privilege Escalation via WebDialer
CVE-2026-20230 is a critical-rated SSRF vulnerability in Cisco Unified CM and Unified CM SME that lets unauthenticated remote attackers write files and escalate privileges to root when WebDialer is enabled.
TL;DR
- CVE-2026-20230 is an SSRF vulnerability (CWE-918) in Cisco Unified Communications Manager (Unified CM) and Unified CM SME, published 2026-06-03.
- CVSS base score is 8.6 (High), but Cisco rates it Critical due to potential root privilege escalation.
- Exploitation requires no authentication and no user interaction, and is only possible when the WebDialer service is enabled (disabled by default).
- No in-the-wild exploitation is confirmed at the time of writing; the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
- Immediate action: disable WebDialer if not required, and apply the remediation described in the Cisco Security Advisory.
What is CVE-2026-20230?
CVE-2026-20230 is a server-side request forgery (SSRF) flaw in Cisco Unified CM and Unified CM SME caused by improper input validation of specific HTTP requests. An unauthenticated remote attacker sends a crafted HTTP request through the WebDialer interface, forcing the server to write attacker-controlled files to the underlying operating system - files that can subsequently be used to escalate privileges to root.
SSRF vulnerabilities (CWE-918) trick a server into making or processing requests on behalf of an attacker. In this case the impact goes beyond typical SSRF data exfiltration: the file-write primitive creates a path to full system compromise. That two-stage chain - SSRF leading to arbitrary file write, then root escalation - is why Cisco overrode the CVSS-implied High rating and assigned a Critical Security Impact Rating.
Who is affected?
The following Cisco products are confirmed affected:
- Cisco Unified Communications Manager (Unified CM) - all versions where the WebDialer service is enabled.
- Cisco Unified Communications Manager Session Management Edition (Unified CM SME) - all versions where the WebDialer service is enabled.
Deployments where WebDialer has never been activated are not directly exposed, but administrators should verify this actively rather than assuming the default has not been changed.
How severe is it?
The CVSS 3.1 base score is 8.6, computed from the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N.
Breaking that vector down:
- AV:N / AC:L - reachable over the network with low attack complexity; no special conditions needed.
- PR:N / UI:N - zero authentication, zero user interaction required.
- S:C - the scope is Changed, meaning the vulnerable component (Unified CM) impacts resources beyond itself, reflected in the OS-level file writes.
- C:N / I:H / A:N - no direct confidentiality or availability impact, but high integrity impact because the attacker can write arbitrary files.
The numeric score alone understates the risk. Cisco's own advisory explicitly assigns a Critical SIR because those written files serve as a stepping stone to root-level privilege escalation, which would give an attacker full control over the underlying OS of a system that sits at the heart of enterprise telephony infrastructure. A detailed independent analysis of the exploit chain is available via a researcher write-up by Deniz Halil.
Is it being exploited?
No confirmed in-the-wild exploitation has been reported. CVE-2026-20230 is not listed in the CISA Known Exploited Vulnerabilities catalog as of this writing. However, the combination of network accessibility, zero authentication required, and a clear path to root escalation makes this a high-priority target for threat actors. Organizations should not wait for confirmed exploitation before acting.
How to fix and mitigate it
-
Apply the vendor patch - consult the Cisco Security Advisory cisco-sa-cucm-ssrf-cXPnHcW for the specific software release guidance applicable to your version. Do not rely on version numbers published elsewhere; follow the official advisory directly.
-
Disable WebDialer if not operationally required - this is the most effective immediate workaround. WebDialer is disabled by default; if your deployment does not use it, disable or confirm it is already off:
# On Unified CM Administration, navigate to:
# System > Service Parameters > [Publisher Node] > Cisco WebDialer Web Service
# Set the service to "Stopped" and set startup type to "Manual"
# Alternatively, via CLI on the CUCM node:
utils service stop Cisco WebDialer Web Service
-
Restrict access to the WebDialer HTTP interface - if WebDialer must remain active, use network ACLs or firewall rules to limit which source IPs can reach the relevant port. Prevent any direct internet exposure of Unified CM administrative and service interfaces.
-
Segment Unified CM from untrusted networks - place Unified CM nodes behind a dedicated voice VLAN and deny general-purpose internet routing to those segments.
-
Monitor for anomalous HTTP requests - enable logging of inbound HTTP requests to the Unified CM web layer and alert on unexpected patterns targeting WebDialer endpoints.
How to detect exposure
- Check WebDialer service status on every Unified CM node via the Cisco Unified Serviceability interface (Tools > Control Center - Feature Services) or via CLI with
utils service list. - Review Unified CM version against the affected ranges listed in the official advisory to confirm whether a patch has been applied.
- Search HTTP access logs on Unified CM for requests to
/webdialer/endpoints originating from unexpected or external IP addresses, particularly those containing unusual URI parameters or encoded payloads. - Audit OS-level file changes - because exploitation results in file writes to the underlying OS, file integrity monitoring (FIM) on directories writable by the Unified CM application user can surface post-exploitation artifacts.
- Check SIEM or NDR for SSRF-pattern traffic - outbound connections from Unified CM to internal RFC-1918 addresses or metadata service IPs (e.g., 169.254.169.254) that the system would not normally initiate can indicate SSRF activity.
Frequently asked questions
Does an attacker need credentials to exploit CVE-2026-20230?
No. The CVSS vector confirms PR:N (no privileges required) and UI:N (no user interaction). Any unauthenticated remote attacker who can reach the WebDialer HTTP interface can send the crafted request, making perimeter exposure especially dangerous.
Is WebDialer enabled by default on Cisco Unified CM?
No. Cisco states WebDialer is disabled by default. Organizations that have never deliberately activated it are not exposed. The first remediation step is to verify whether WebDialer is running, and disable it immediately if it is not operationally required.
Can the attacker read sensitive data directly through this SSRF flaw?
Not directly. The CVSS vector shows C:N (no confidentiality impact). The immediate impact is high integrity loss - the attacker writes files to the underlying OS. Those files can then be used in a follow-on step to escalate to root, making the eventual impact far more serious.
Has Cisco elevated the severity rating beyond the CVSS score?
Yes. The base CVSS score is 8.6, which maps to High. However, Cisco assigned a Security Impact Rating of Critical because successful exploitation can lead to root-level privilege escalation, a consequence the numeric score alone does not fully represent.
