- Critical 9.8
- Known exploited (CISA KEV)
CVE-2026-20045
A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending a sequ…
Scores
The facts
- Published
- 21 January 2026
- Last changed
- 17 June 2026
- NVD status
- Analyzed
- Severity
- Critical, CVSS 9.8 out of 10 (version 3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- Affects
- cisco unified communications manager
- cisco unified communications manager im and presence service
- cisco unity connection
- Known exploited
- Yes. CISA added it to the Known Exploited Vulnerabilities catalogue on 21 January 2026.
- EPSS
- 4.5% chance of exploitation activity in the next 30 days (percentile 91).
Is there a Securelyn advisory?
Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.