A high-severity server-side request forgery (SSRF) vulnerability in Cisco Unified Communications Manager is being actively exploited by threat actors. The flaw, CVE-2026-20230, allows attackers to bypass network restrictions and access internal systems.
■ Active Exploitation Confirmed
Cisco Unified Communications Manager (CM) users face immediate risk from CVE-2026-20230, a critical SSRF vulnerability currently targeted in the wild. The vulnerability enables attackers to make unauthorized requests from the affected server to internal or external systems, potentially exposing sensitive data or enabling lateral movement within networks.
■ Technical Details
SSRF vulnerabilities occur when an application fetches remote resources without properly validating user input. In this case, the flaw resides in Cisco's communications platform, which is widely deployed in enterprise environments. By exploiting the vulnerability, attackers can circumvent network access controls and interact with services that should be isolated.
■ Scope of Impact
Cisco Unified CM is a core component of many organization's voice and video infrastructure. The platform manages communications across enterprises, making it a high-value target. Organizations using affected versions are at risk of data exfiltration, credential theft, and further system compromise.
■ Mitigation Steps
Cisco has released security advisories with patch information. Organizations should prioritize updating to patched versions immediately. Additionally, implementing network segmentation and access controls can help limit the blast radius if exploitation occurs.
For those unable to patch immediately, monitoring for unusual outbound connections from Unified CM servers and restricting server network access to essential services only can provide interim protection.
■ Industry Context
This marks another critical vulnerability in widely-deployed enterprise infrastructure. Communications platforms continue to attract threat actor attention due to their central role in organizational networks and the sensitive data they handle.
Security group Nightmare Eclipse has disclosed a zero-day vulnerability in Microsoft Defender named 'ShieldBreak' that grants SYSTEM-level privileges. The exploit emerged after Microsoft's August 2026 Patch Tuesday updates.
Wesco, a global supply chain and distribution company, acknowledged a cybersecurity incident following claims by ExfilSquad that it stole company data. The investigation is ongoing.
Signal has rolled out Automatic Key Verification, a new security feature designed to prevent man-in-the-middle attacks on encrypted messages. The feature strengthens Signal's existing encryption protections.
Hackers compromised a heat-and-power facility in Poland that serves approximately 50,000 residents by exploiting a private APN connection to access its operational technology network.