⚠ Actively exploited
Added to CISA KEV on 2026-01-21. Federal agencies required to patch by 2026-02-11. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable..
CVE-2026-20045 — Code Injection in Cisco Unified Communications Manager
Severity
9.8CRITICALNVD
CNA8.2VulnCheck8.2
EPSS
1.3%
top 19.96%
CISA KEV
KEV
Added 2026-01-21
Due 2026-02-11
Exploit
No known exploits
Affected products
Timeline
PublishedJan 21
KEV addedJan 21
Latest updateJan 22
KEV dueFeb 11
CISA Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device.
This vulnerability is due to improper validation of user-supplied …
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9
Affected Packages6 packages
🔴Vulnerability Details
3GHSA▶
GHSA-h4w3-hxw6-99q7: A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME)↗2026-01-21