Cisco has disclosed a critical server-side request forgery (SSRF) vulnerability, tracked as CVE-2026-20230, affecting Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (Unified CM SME). The flaw resides in the Cisco WebDialer Web Service component and is caused by improper input validation of specific HTTP requests. Although assigned a CVSS v3.1 score of high, Cisco has classified the issue as Critical due to the severe impact that successful exploitation can have on affected systems. The vulnerability can be exploited remotely without authentication, making it particularly dangerous for organizations that have WebDialer enabled.

The vulnerability allows an attacker to send specially crafted HTTP requests to the WebDialer interface, triggering SSRF behavior that forces the server to interact with attacker-controlled resources. By abusing this functionality, a threat actor can create arbitrary files on the underlying operating system. These file-write capabilities can subsequently be leveraged to modify system configurations, deploy malicious scripts, or introduce backdoors that facilitate privilege escalation. Successful exploitation can ultimately result in root-level access, providing complete control over the Unified CM server and its associated services.

A compromise of a Unified CM server can have significant operational and security consequences. Attackers with root privileges could manipulate call routing, alter system configurations, monitor or intercept communications, implant persistent malware, and use the compromised server as a pivot point for lateral movement within the organization's voice and collaboration infrastructure. In large enterprise environments where Unified CM serves as a core call-control platform, exploitation of this flaw could lead to widespread service disruption and provide adversaries with a strategic foothold inside critical communication networks.

The vulnerability only affects deployments where the Cisco WebDialer Web Service is enabled, as the feature is disabled by default. Cisco has released fixes in Unified CM/SME 14SU6 and Unified CM/SME 15SU5, while additional COP patches are available for supported versions. Cisco's PSIRT has confirmed the existence of proof-of-concept (PoC) exploit code, although no active exploitation has been observed at the time of disclosure. Since no effective workaround exists, Cisco recommends upgrading to the patched releases as the primary remediation measure. Organizations unable to immediately patch should disable the WebDialer service if not required, restrict access to management interfaces, and closely monitor systems for suspicious HTTP requests and unexpected file creation activity.