Background exploitation KEV catalog No authentication

CVE-2026-20045

Cisco Unified Communications Products Code Injection Vulnerability

CheckOps priority index

5.2/10 Patch within 7 days

Severity8.2

Probability0.5

Exploitation3/5

Severity = CVSS. Probability = EPSS (FIRST). Exploitation = public signals: KEV, EUVD, ransomware, EPSS above 10 %, no account required.

EPSS · today 4.5% higher than 91.6% of CVEs

CVSS 3.1 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:

Exploited for 286 days 21 Jan 2026

CISA due date 11 Feb 2026 for US federal agencies

Exploitation probability EPSS · FIRST

EPSS probability (%)Percentile among all CVEs

Exploitation signals 3 / 5

KEV catalog (CISA)21 Jan 2026
Exploited in EUVD (ENISA)21 Jan 2026
Used by ransomwareno
EPSS above 10 %4.5%
No account, over the networkyes

What to do

Fix

Apply the vendor’s fix as soon as it is available.

CISA guidance: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Meanwhile

Take the service off the internet or restrict access to it, watch the logs and look for signs of compromise.

Manufacturers (CRA)

Exploited vulnerability in your product: early warning to ENISA within 24 h, then notification within 72 h (Article 14 of the Cyber Resilience Act). The CRA explained

Description ENISA EUVD

A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device.  This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root.  Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.

Affected products

Cisco Unified Communications ManagerCisco Unified Communications Manager IM and Presence ServiceCisco Unity ConnectionUnified Communications Manager

Affected versions

12.5(1)SU3
15SU2
12.5(1)
15
14SU1
14
12.5(1)SU8
14SU2
12.5(1)SU4
12.5(1)SU5
12.5(1)SU6
15.0.1.13015-1

Weaknesses (CWE)

CWE-94

Open source packages OSV

Affected libraries according to OSV, with fixed versions.

Timeline

21 Jan 2026
Published
21 Jan 2026
Exploitation reported (ENISA)
21 Jan 2026
Added to the KEV catalog
11 Feb 2026
CISA remediation due date

References

Other exploited vulnerabilities from the same vendor

CVE-2026-76418Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
5.3 · Rising fast
CVE-2026-76519Cisco Secure Email Gateway Relative Path Traversal Vulnerability
5.8 · Rising fast
CVE-2026-76504Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
7.5 · Actively exploited
CVE-2026-76460Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability
8.7 · Actively exploited
CVE-2026-76461Cisco Secure Email Gateway SQL Injection Vulnerability
7.2 · Actively exploited
CVE-2026-20079Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability
9.1 · Actively exploited