This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Cisco fixes a critical, actively exploited vulnerability

With versions 14SU5 and 15SU4 (03/2026), Cisco fixes a critical, actively exploited vulnerability in the following products [1][2]: - Unified Communications Manager (Unified CM) - Cisco Unified Communications Manager Session Management Edition (Unified CM SME) - Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) - Cisco Unity Connection - Cisco Webex Calling Dedicated Instance The patch for Cisco Unity Connection version 14 is available at [3], for version 15 at [4]. The patch for the other products in version 14 can be found at [5], in version 15 at [6][7].

Cisco Unified CM, Webex & Unity Connection - RCE, privilege escalation (CVE-2026-20045)
CVSS 8.2 (High)

An unauthenticated remote attacker can execute arbitrary commands on the operating system of the affected device and then elevate their privileges to root by sending specially crafted HTTP requests to the administrative web interface [1].

The vulnerability is present in products:

  • Cisco Unified Communications Manager; >=12.5(1), <=12.5(1)SU9; >=14, <14SU5; >=15, <15SU4;
  • Cisco Unified Communications Manager IM and Presence Service; >=12.5(1), <=12.5(1)SU9; >=14, <14SU5; >=15, <15SU4;
  • Cisco Unified Communications Manager Session Management Edition ; >=12.5(1), <=12.5(1)SU9; >=14, <14SU5; >=15, <15SU4;
  • Cisco Unity Connection; >=12.5(1), <=12.5(1)SU9; >=14, <14SU5; >=15, <15SU4;
  • Webex Calling Dedicated Instance; >=12.5(1), <=12.5(1)SU9; >=14, <14SU5; >=15, <15SU4;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

More information:

The vulnerability was publicly disclosed 21. 1. 2026.

By CESNET, z.s.p.o. Michaela Ručková on 22. 1. 2026.

CESNET, z.s.p.o. Logo