Critical Alert: Cisco Unveils Fix for Actively Exploited Unified Communications Zero-Day Vulnerability 🚨
Cisco has rolled out urgent updates to tackle a critical remote code execution (RCE) vulnerability affecting its Unified Communications and Webex Calling products, which has been exploited in the wild as a zero-day.
Tracked as CVE-2026-20045, this flaw impacts multiple Cisco products, including Unified Communications Manager (Unified CM), Unified CM Session Management Edition (SME), Unified CM IM & Presence, Cisco Unity Connection, and Webex Calling Dedicated Instance. But here's where it gets scary... an attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface, potentially gaining user-level access and escalating privileges to root.
The Vulnerability Explained
The issue stems from inadequate validation of user-supplied input in HTTP requests. Cisco warns that successful exploitation could allow attackers to execute arbitrary commands on the underlying operating system, posing a significant security risk.
Affected Products and Fixes
Cisco has released software updates and patches to address the vulnerability. Affected products and corresponding fixes include:
- Cisco Unified CM, Unified CM IM&P, Unified CM SME, and Webex Calling Dedicated Instance:
- Version 12.5: Migrate to a fixed release
- Version 14: 14SU5 or apply patch file ciscocm.V14SU4aCSCwr21851remotecodev1.cop.sha512
- Version 15: 15SU4 (Mar 2026) or apply patches ciscocm.V15SU2CSCwr21851remotecodev1.cop.sha512 and ciscocm.V15SU3CSCwr21851remotecodev1.cop.sha512
- Cisco Unity Connection:
- Version 12.5: Migrate to a fixed release
- Version 14: 14SU5 or apply patch file ciscocm.cuc.CSCwr29208_C0266-1.cop.sha512
- Version 15: 15SU4 (Mar 2026) or apply patch file ciscocm.cuc.CSCwr29208_C0266-1.cop.sha512
Urgent Action Required
Cisco's Product Security Incident Response Team (PSIRT) confirms exploitation attempts in the wild, urging customers to upgrade to the latest software immediately. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has also added CVE-2026-20045 to its Known Exploited Vulnerabilities (KEV) Catalog, requiring federal agencies to deploy updates by February 11, 2026.
What do you think? 🤔 Should companies prioritize patching or wait for further guidance? Share your thoughts in the comments! 💬
