The Dialer Nobody Turns On: CVE-2026-20230 Still Gave Attackers Root on Cisco Unified CM
An unauthenticated SSRF in a disabled-by-default click-to-call service scored 8.6 — Cisco overrode its own CVSS math and called it Critical. Three weeks later, honeypots watched it drop webshells over Tor.
Cisco Unified Communications Manager (Unified CM) is the call-processing brain behind enterprise VoIP — the box that routes calls, holds the dial plan, and talks to every phone, gateway and trunk in the building. CVE-2026-20230 is an unauthenticated server-side request forgery (SSRF) in one of its optional services that lets a remote attacker with no credentials write files to the underlying operating system — a path Cisco itself says ends in root.
Scores as of 2026-08-11live record →
The number Cisco didn't trust
Read Cisco's advisory closely and it does something advisories rarely do: it argues with its own CVSS score. The vector — Scope Changed, Confidentiality None, Integrity High, Availability None — computes to 8.6, a High. Cisco assigned the bulletin a Security Impact Rating of Critical anyway, and told you exactly why in the advisory text itself: "Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root."
What the score says vs. what Cisco did about it
- Confidentiality impact: None — SSRF alone doesn't read secrets
- Availability impact: None — it isn't a crash or DoS
- Integrity impact: High — the base metric that's actually pulling weight
- The write primitive lands on the OS, not just app data
- A file write on Unified CM is a documented path to root
- SIR is Cisco's own judgment call layered on top of the raw score
The catch: it's off by default
How an SSRF becomes root
The root cause is CWE-918 (SSRF): WebDialer's HTTP request handling doesn't properly validate a parameter that ends up controlling a server-side fetch. Per SSD Secure Disclosure's technical writeup, an unauthenticated attacker can abuse this to first resolve the box's real hostname, then coerce it into fetching a file://-style target — turning a request-forgery bug into an arbitrary file write on the host filesystem. On Unified CM, a file write into the right location is enough to get code running as root; the SSRF is the door, the file write is the crowbar.
CVE-2026-20230 — from probe to root
- Unauthenticated HTTP request to WebDialer — CWE-918: input validation gap lets the attacker control a server-side fetch target.
- file:// write primitive — SSRF is coerced into writing an attacker-chosen file to the underlying OS.
- Rogue Apache Axis service deployed — Observed in the wild: the write primitive plants a malicious Axis service on the host.
- JSP file-writer dropped — The rogue Axis service is used to write a first-stage JSP webshell.
- Second-stage command shell — Full command execution shell planted under /platform-services/axis2-web/.
- Root on the call-processing server — Cisco: the write primitive can be used later to elevate to root.
From "PoC exists" to webshells over Tor, in three weeks
The timeline is the honest, unglamorous shape most exploited bugs actually follow: publish, PoC surfaces, nothing happens for weeks, then it does — fast.
Disclosure to exploitation
- Cisco publishes the advisoryCVSS 8.6, SIR Critical, fixed releases named. Cisco PSIRT notes public PoC exploit code is already available, but reports no evidence yet of active exploitation.
- Threat-intel firm Defused observes exploitation beginA single attacking IP sends a WebDialer request writing a marker file,
/tmp/cve-2026-20230-test.txt— consistent with automated vulnerability probing, not yet a payload. - Probing escalates to webshell dropsDefused's honeypots see automated sweeps, routed over Tor, chaining the SSRF into a rogue Apache Axis service, a JSP file-writer, then a full command-execution shell.
- CISA adds CVE-2026-20230 to KEVFederal remediation deadline set for 2026-06-28 — a two-day fuse.
- Cisco revises the advisory (v1.1)Advisory updated; PSIRT confirms it is aware of active exploitation.
Are you patched?
| Release train | Status per Cisco | Fixed in |
|---|---|---|
| Unified CM / Unified CM SME 14.0 – 14SU5 | Affected | 14SU6 |
| Unified CM / Unified CM SME 15.0 – 15SU4a | Affected | 15SU5 — targeted for a later 2026 release; an interim COP (Cisco Options Package) is offered for 15.x pending that release |
| Any train with WebDialer never enabled | Not exploitable via this path | N/A — but confirm before assuming you're safe |
What our own record still doesn't have
What to do now
- Check if WebDialer is even running. Cisco Unified Serviceability → Tools → Service Activation. If it's off, this specific CVE isn't your exposure — but confirm, don't assume.
- Patch to a fixed build. 14.x → 14SU6. 15.x → 15SU5 when generally available, or the interim COP in the meantime.
- Can't patch immediately? Deactivate the WebDialer service via Service Activation. Cisco calls this mitigation tested and successful, not a substitute for the fix.
- Hunt for the marker and the chain. Look for a file named
cve-2026-20230-test.txtunder/tmp, unexpected Apache Axis services, JSP files you didn't deploy, and anything under/platform-services/axis2-web/that isn't part of a standard install. - Watch egress. The in-the-wild activity was routed over Tor. Outbound Tor connections from a call-processing server are themselves worth an alert, independent of this specific bug.
- If WebDialer was ever enabled and internet-reachable, assume compromise until you've hunted. A patched box can still have an attacker's webshell sitting on it from before the patch.
CVSS / EPSS / KEV data as of 2026-08-11