Answer in brief
CVE-2026-20230 records a High severity (CVSS 8.6) vulnerability in Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability. The current sources mark it as known exploited. The current feed maps Cisco/Cisco Unified Communications Manager (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.6. Known-exploitation status makes exposure review time-sensitive. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Cisco/Cisco Unified Communications Manager (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Cisco/Cisco Unified Communications Managergeneric | 14 || 14SU1 || 14SU2 || 14SU3 || 15 || 15SU1 || 14SU4 || 14SU4a || 15SU1a || 15SU2 || 15.0.1.13010-1 || 15.0.1.13011-1 || 15.0.1.13012-1 || 15.0.1.13013-1 || 15.0.1.13014-1 || 15.0.1.13015-1 || 15.0.1.13016-1 || 15.0.1.13017-1 || 15SU3a || 14SU5 || 15SU4 || 15SU4a | Not reported |
Published upstream
Jun 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 24, 2026
Added to CISA KEV
Jun 25, 2026
Evidence: source:kev:kev:kev:recordA vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root. Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root. Note: To exploit this vulnerability, the WebDialer service must be enabled. WebDialer is disabled by default.
Quoted source text, attributed separately from HOL analysis.