LmCast :: Stay tuned in

Cisco fixes Unified Communications RCE zero day exploited in attacks

Recorded: Jan. 21, 2026, 11:03 p.m.

Original Summarized

Cisco fixes Unified Communications RCE zero day exploited in attacks

News

Featured
Latest

Credential-stealing Chrome extensions target enterprise HR platforms

Microsoft releases OOB Windows updates to fix shutdown, Cloud PC bugs

Jordanian pleads guilty to selling access to 50 corporate networks

Ingram Micro says ransomware attack affected 42,000 people

Chainlit AI framework bugs let hackers breach cloud environments

Cisco fixes Unified Communications RCE zero day exploited in attacks

New Android malware uses AI to click on hidden browser ads

Online retailer PcComponentes says data breach claims are fake

Tutorials

Latest
Popular

How to access the Dark Web using the Tor Browser

How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11

How to use the Windows Registry Editor

How to backup and restore the Windows Registry

How to start Windows in Safe Mode

How to remove a Trojan, Virus, Worm, or other Malware

How to show hidden files in Windows 7

How to see hidden files in Windows

Webinars
Downloads

Latest
Most Downloaded

Qualys BrowserCheck

STOPDecrypter

AuroraDecrypter

FilesLockerDecrypter

AdwCleaner

ComboFix

RKill

Junkware Removal Tool

Deals

Categories

eLearning

IT Certification Courses

Gear + Gadgets

Security

VPNs

Popular

Best VPNs

How to change IP address

Access the dark web safely

Best VPN for YouTube

Forums
More

Virus Removal Guides
Startup Database
Uninstall Database
Glossary
Send us a Tip!
Welcome Guide

HomeNewsSecurityCisco fixes Unified Communications RCE zero day exploited in attacks

Cisco fixes Unified Communications RCE zero day exploited in attacks

By Lawrence Abrams

January 21, 2026
05:16 PM
0

Cisco has fixed a critical Unified Communications and Webex Calling remote code execution vulnerability, tracked as CVE-2026-20045, that has been actively exploited as a zero-day in attacks.
Tracked as CVE-2026-20045, the flaw impacts Cisco Unified Communications Manager (Unified CM), Unified CM Session Management Edition (SME), Unified CM IM & Presence, Cisco Unity Connection, and Webex Calling Dedicated Instance.
"This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device," warns Cisco's advisory.

"A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root."
While the vulnerability has a CVSS score of 8.2, Cisco assigned it a Critical severity rating, as exploitation leads to root access on servers.
Cisco has released the following software updates and patch files to address the vulnerability:
Cisco Unified CM, Unified CM IM&P, Unified CM SME, and Webex Calling Dedicated Instance Release:
Version
First Fixed Release
12.5
Migrate to a fixed release.
14
14SU5 or apply patch file:ciscocm.V14SU4a_CSCwr21851_remote_code_v1.cop.sha512
15
15SU4 (Mar 2026) or apply patch file:ciscocm.V15SU2_CSCwr21851_remote_code_v1.cop.sha512ciscocm.V15SU3_CSCwr21851_remote_code_v1.cop.sha512
Cisco Unity Connection Release:
Version
First Fixed Release
12.5
Migrate to a fixed release.
14
14SU5 or apply patch file:ciscocm.cuc.CSCwr29208_C0266-1.cop.sha512
15
15SU4 (Mar 2026) or apply patch file:ciscocm.cuc.CSCwr29208_C0266-1.cop.sha512
The company says the patches are version specific, so the README should be reviewed before applying patches.
Cisco's Product Security Incident Response Team (PSIRT) has confirmed that attempts to exploit the flaw have been observed in the wild, urging customers to upgrade to the latest software as soon as possible.
The company also said there are no workarounds that can mitigate the flaw without installing updates.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-20045 to its Known Exploited Vulnerabilities (KEV) Catalog and given federal agencies until February 11, 2026, to deploy updates.
Earlier this month, Cisco patched a Identity Services Engine (ISE) vulnerability with public proof-of-concept exploit code and a AsyncOS zero-day exploited since November.

7 Security Best Practices for MCP
As MCP (Model Context Protocol) becomes the standard for connecting LLMs to tools and data, security teams are moving fast to keep these new services safe.
This free cheat sheet outlines 7 best practices you can start using today.
Download Now

Related Articles:
Cisco warns of unpatched AsyncOS zero-day exploited in attacksCisco finally fixes AsyncOS zero-day exploited since NovemberNew Windows zero-day exploited by 11 state hacking groups since 2017Google fixes two Android zero days exploited in attacks, 107 flawsVMware ESXi zero-days likely exploited a year before disclosure

Actively Exploited
Cisco
Cisco Unified Communications
Vulnerability
Zero-Day

Lawrence Abrams
Lawrence Abrams is the owner and Editor in Chief of BleepingComputer.com. Lawrence's area of expertise includes Windows, malware removal, and computer forensics. Lawrence Abrams is a co-author of the Winternals Defragmentation, Recovery, and Administration Field Guide and the technical editor for Rootkits for Dummies.

Previous Article
Next Article

Post a Comment Community Rules

You need to login in order to post a comment

Not a member yet? Register Now

You may also like:

Popular Stories

Microsoft releases OOB Windows updates to fix shutdown, Cloud PC bugs

Ingram Micro says ransomware attack affected 42,000 people

New PDFSider Windows malware deployed on Fortune 100 firm's network

Sponsor Posts

Discover how to scale IT infrastructure reliably without adding toil or burnout.

Identity Governance & Threat Detection in one: Get a guided tour of our platform

Discover how phishing kits are sold and deployed. Download the full research report.

  Upcoming Webinar

Follow us:

Main Sections

News
Webinars
VPN Buyer Guides
SysAdmin Software Guides
Downloads
Virus Removal Guides
Tutorials
Startup Database
Uninstall Database
Glossary

Community

Forums
Forum Rules
Chat

Useful Resources

Welcome Guide
Sitemap

Company

About BleepingComputer
Contact Us
Send us a Tip!
Advertising
Write for BleepingComputer
Social & Feeds
Changelog

Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure

Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved

Login

Username

Password

Remember Me

Sign in anonymously

Sign in with Twitter

Not a member yet? Register Now


Reporter

Help us understand the problem. What is going on with this comment?

Spam

Abusive or Harmful

Inappropriate content

Strong language

Other

Read our posting guidelinese to learn what content is prohibited.

Submitting...
SUBMIT

Cisco has addressed a critical Remote Code Execution (RCE) vulnerability, designated as CVE-2026-20045, that was actively exploited in real-world attacks. This vulnerability impacted several Cisco Unified Communications products, including Cisco Unified Communications Manager (Unified CM), Unified CM Session Management Edition (SME), Unified CM IM & Presence, Cisco Unity Connection, and Webex Calling Dedicated Instance. The core issue stemmed from improper handling of user-supplied input within HTTP requests, allowing an attacker to potentially obtain user-level access and subsequently escalate privileges to root access on the affected servers. The Common Vulnerability Scoring System (CVSS) assigned a score of 8.2, reflecting the significant risk posed by this exploitation.

Cisco’s Product Security Incident Response Team (PSIRT) confirmed that exploitation attempts had been observed, emphasizing the urgency for customers to deploy available patches. The company released specific software updates and patch files tailored to the affected versions. Version 12.5 required a migration to a fixed release. Subsequent versions, including 14 and 15, offered further refinements with patch files available for download. Notably, the company highlighted the version-specificity of the updates and urged careful review of the accompanying README files before application.

The vulnerability was tracked within the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) Catalog, prompting federal agencies to address the issue by February 11, 2026. Prior to this announcement, Cisco had previously patched an Identity Services Engine (ISE) vulnerability, which included public proof-of-concept exploit code and had been exploited since November. This indicates a pattern of rapid response initiated by Cisco to mitigate emerging threats.

The active exploitation of CVE-2026-20045 underscored the importance of maintaining up-to-date security measures for critical communication infrastructure. The consequences of a successful attack, including unauthorized access and potential root-level control, were substantial. There were no workaround solutions available to neutralize the vulnerability without installing the designated patches. Cisco’s response, combined with CISA’s classification, signaled a coordinated effort to reduce the attack surface and minimize potential harm. The vulnerability management process involved rapid detection, analysis, and the expeditious release of security updates, reflecting best practices for incident response within the cybersecurity realm.