Cisco has launched contemporary patches to deal with what it described as a “crucial” security vulnerability impacting a number of Unified Communications (CM) merchandise and Webex Calling Devoted Occasion that it has been actively exploited as a zero-day within the wild.
The vulnerability, CVE-2026-20045 (CVSS rating: 8.2), might allow an unauthenticated distant attacker to execute arbitrary instructions on the underlying working system of a prone machine.
“This vulnerability is because of improper validation of user-supplied enter in HTTP requests,” Cisco mentioned in an advisory. “An attacker might exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based administration interface of an affected machine. A profitable exploit might enable the attacker to acquire user-level entry to the underlying working system after which elevate privileges to root.”
The crucial score for the flaw is because of the truth that its exploitation might enable for privilege escalation to root, it added. The vulnerability impacts the next merchandise –
- Unified CM
- Unified CM Session Administration Version (SME)
- Unified CM IM & Presence Service (IM&P)
- Unity Connection
- Webex Calling Devoted Occasion
It has been addressed within the following variations –
Cisco Unified CM, CM SME, CM IM&P, and Webex Calling Devoted Occasion –
- Launch 12.5 – Migrate to a set launch
- Launch 14 – 14SU5 or apply patch file: ciscocm.V14SU4a_CSCwr21851_remote_code_v1.cop.sha512
- Launch 15 – 15SU4 (Mar 2026) or apply patch file: ciscocm.V15SU2_CSCwr21851_remote_code_v1.cop.sha512 or ciscocm.V15SU3_CSCwr21851_remote_code_v1.cop.sha512
Cisco Unity Connection
- Launch 12.5 – Migrate to a set launch
- Launch 14 – 14SU5 or apply patch file: ciscocm.cuc.CSCwr29208_C0266-1.cop.sha512
- Launch 15 – 15SU4 (Mar 2026) or apply patch file: ciscocm.cuc.CSCwr29208_C0266-1.cop.sha512
The networking tools main additionally mentioned it is “conscious of tried exploitation of this vulnerability within the wild,” urging clients to improve to a set software program launch to deal with the difficulty. There are presently no workarounds. An nameless exterior researcher has been credited with discovering and reporting the bug.
The event has prompted the U.S. Cybersecurity and Infrastructure Safety Company (CISA) so as to add CVE-2026-20045 to its Identified Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Government Department (FCEB) businesses to use the fixes by February 11, 2026.
The invention of CVE-2026-20045 comes lower than every week after Cisco launched updates for an additional actively exploited crucial security vulnerability affecting AsyncOS Software program for Cisco Safe Electronic mail Gateway and Cisco Safe Electronic mail and Net Supervisor (CVE-2025-20393, CVSS rating: 10.0) that would allow an attacker to execute arbitrary instructions with root privileges.
