CVE-2026-20230: Cisco Unified CM — SSRF to Root via Webshell

Background

Cisco Unified Communications Manager (Unified CM) is the enterprise call processing platform deployed at the core of most large Cisco voice and unified communications environments. It handles IP telephony, voicemail integration, and collaboration services for tens of thousands of enterprise customers globally. Unified CM Session Management Edition (Unified CM SME) serves as the central hub in multi-cluster deployments.

CVE-2026-20230 is a server-side request forgery (SSRF) vulnerability (CWE-918) in Unified CM’s WebDialer component, affecting Releases 14 and 15. The CVSS 3.1 base score is 8.6 (HIGH). Cisco’s own security impact rating is Critical, reflecting that successful exploitation chains through from an unauthenticated SSRF to file writes to webshell deployment — achieving persistent code execution on the communications server.

CISA added CVE-2026-20230 to the Known Exploited Vulnerabilities catalog on June 25, 2026, with a three-day federal deadline. A public proof-of-concept was published by SSD Secure Disclosure on the same day. Exploitation in the wild has been observed since June 22, 2026.

Technical Mechanism

The vulnerable component is the Cisco WebDialer Web Service, a Tomcat-hosted servlet that provides click-to-call browser integration for Cisco Unified CM. WebDialer processes URL parameters supplied by browser clients and makes server-side HTTP requests to perform call setup operations. The service is disabled by default but widely enabled in enterprise deployments.

The SSRF flaw arises because WebDialer insufficiently validates the URL parameters it processes before making outbound requests. An attacker can supply a file:// URI scheme in place of a legitimate HTTP URL. Because the SSRF runs with the permissions of the application server process, file:// requests can read and write to the local filesystem.

The observed in-the-wild exploitation chain proceeds as follows:

1. An unauthenticated attacker sends a crafted HTTP request to the WebDialer service containing a file:// payload.
2. The SSRF is used to deploy a rogue Apache Axis service on the target. Apache Axis is a web services framework included in the Unified CM installation; abusing it to host an attacker-controlled service provides an execution environment for arbitrary Java code.
3. The rogue Axis service writes a first-stage JSP file-writer to disk.
4. The first-stage file-writer drops a second-stage command-execution JSP webshell at /platform-services/axis2-web/.

The result is persistent, unauthenticated web-based command execution on the Unified CM server. The webshell survives reboots unless explicitly removed.

Cisco notes that the written files “could be used later to elevate to root.” The precise escalation mechanism from the webshell’s effective user to full root has not been publicly documented; the observed exploitation achieves persistent web-accessible RCE as the application server user, which in many Unified CM deployments provides sufficient access for lateral movement.

Real-World Exploitation Evidence

Exploitation began on June 22, 2026, initially observed by Defused threat intelligence as automated scanning from a single IP address. Activity escalated by June 24–25, 2026 to Tor-routed automated sweeps deploying the multi-stage webshell chain described above.

A reconnaissance fingerprint has been observed: creation of a file /tmp/cve-2026-20230-test.txt during initial exploitation probing, which serves as a simple file-write confirmation before the attacker proceeds to webshell deployment.

SSD Secure Disclosure published a public PoC on June 25, 2026. Cisco PSIRT confirmed PoC availability in its advisory. The combination of active exploitation, Tor-routed automated tooling, and a published PoC makes opportunistic mass exploitation by a wide range of actors likely in the near term.

No named threat actor or specific campaign has been attributed to observed exploitation as of June 25, 2026. The automated, anonymised nature of observed activity is consistent with initial access broker operations or opportunistic ransomware precursor activity.

Impact Assessment

• Unauthenticated webshell deployment — any network-reachable Unified CM server with WebDialer enabled is exploitable without credentials
• Persistent access — the second-stage webshell at /platform-services/axis2-web/ survives service restarts and provides ongoing access
• Communications infrastructure at risk — Unified CM controls voice and collaboration for the enterprise; a compromised instance provides access to call routing, voicemail, and user directory data
• Privilege escalation path to root — Cisco’s advisory explicitly references the ability to elevate to root, increasing blast radius beyond the application server context
• Public PoC reduces barrier to exploitation — SSD Secure Disclosure’s publication on June 25 means operational tooling is widely available within hours of CISA KEV addition

Affected Versions

Releases prior to 14 (12.x, 11.x) are not listed as affected in the Cisco advisory.

Remediation Steps

1. Apply fixed releases immediately:

   • Upgrade to Unified CM 14SU6 if on Release 14. Released June 3, 2026; apply now.
   • For Release 15, apply the COP1 interim patch while waiting for 15SU5 (scheduled September 2026). The COP1 patch addresses CVE-2026-20230 specifically.
   • Download from Cisco Software Center: software.cisco.com

2. Disable WebDialer if not required (as an immediate interim step before patching):

   • Navigate to Cisco Unified Serviceability > Tools > Control Center — Feature Services
   • Select the server and locate Cisco WebDialer Web Service under CTI Services
   • Set to Deactivated and save
   • This removes the attack surface entirely at the cost of click-to-dial browser integration functionality

3. Scan for webshells. Check for unexpected files at /platform-services/axis2-web/:

   find /opt/cisco/ -path "*/axis2-web/*.jsp" -newer /etc/passwd 2>/dev/null

   Any .jsp files not present before June 22, 2026 should be considered indicators of compromise.

4. Check for /tmp/cve-2026-20230-test.txt. Presence of this file confirms at minimum that a probe reached the system and the file write primitive executed successfully — treat as a confirmed exploitation attempt.

5. Review rogue Axis services. Check the Apache Axis service registry for any service names not present in a clean Unified CM installation. Unexpected entries indicate the rogue service deployment stage succeeded.

6. Rotate credentials. If webshells are found, assume all credentials accessible from the Unified CM server may be compromised: LDAP integration accounts, database credentials, JTAPI/TAPI application user accounts.

Detection Guidance

Filesystem monitoring:

• New .jsp files under /platform-services/axis2-web/ created after June 22, 2026
• Creation of /tmp/cve-2026-20230-test.txt — reconnaissance fingerprint
• Unusual file creation events by the Tomcat or application server process

HTTP access logs (Tomcat/access logs):

• POST requests to WebDialer endpoints from external or unexpected IP addresses
• Requests containing file:// in URL parameters
• HTTP requests to /platform-services/axis2-web/ from source IPs not associated with legitimate Axis administration
• HTTP responses from /platform-services/axis2-web/ to unexpected client IPs

Network telemetry:

• Inbound connections to Unified CM management interfaces from Tor exit nodes or anonymising VPN providers
• Outbound connections from the Unified CM server to external hosts, particularly on non-standard ports (potential reverse shell or C2 beacon)

Suricata signature:

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"Cisco UCM CVE-2026-20230 SSRF Exploit Attempt"; flow:established,to_server; http.uri; content:"webdialer"; nocase; http.request_body; content:"file://"; classtype:web-application-attack; sid:2026230; rev:1;)

IOCs:

• /tmp/cve-2026-20230-test.txt — file write probe confirmation
• Unexpected .jsp files in /platform-services/axis2-web/
• Tor exit node IP addresses initiating WebDialer requests

Timeline

References

• Cisco Security Advisory: cisco-sa-cucm-ssrf-cXPnHcW
• NVD — CVE-2026-20230
• CISA Known Exploited Vulnerabilities Catalog
• BleepingComputer — Cisco Unified CM SME Flaw CVE-2026-20230 Now Exploited in Attacks
• Help Net Security — Cisco Unified CM Flaw Exploited to Drop Webshells
• SOCRadar — CVE-2026-20230 Cisco Unified CM WebDialer SSRF