{"id":"CVE-2026-20045","published":"2026-01-21T17:16:08Z","modified":"2026-06-17T10:16:58Z","title":"Cisco Unified Communications Products Code Injection Vulnerability","vendor":"Cisco","product":"Unified Communications Manager","tier":"core","eol":null,"description":{"text":"A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. \r\n\r\nThis vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root. \r\nNote: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.","provenance":"source","from":"NVD"},"summary":{"text":"Cisco Unified Communications Manager, its SME and IM&P variants, Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance contain an improper input validation flaw in the handling of user-supplied data in HTTP requests to the web-based management interface. An unauthenticated remote attacker can exploit it by sending a sequence of crafted HTTP requests to that interface, without user interaction, to run arbitrary commands on the underlying operating system and then escalate privileges to root.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:44:33Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.04541,"percentile":0.91558,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2026-01-21","dueDate":"2026-02-11","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-rce-mORhqY4b ; https://nvd.nist.gov/vuln/detail/CVE-2026-20045","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-01-21","exploitedFirstSeen":"2026-01-21","ransomware":false,"evidence":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-rce-mORhqY4b","date":"2026-01-21"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-01-21"},{"url":"https://viz.greynoise.io/tags/cisco-unified-communications-manager-input-validation-cve-2026-20045-rce-attempt?days=1","date":"2026-01-22"},{"url":"https://www.recordedfuture.com/blog/january-2026-cve-landscape","date":"2026-02-24"},{"url":"https://cyble.com/reports/H1-2026-Global-Threat-Landscape-Report.pdf","date":"2026-07-27"},{"url":"https://ti.qianxin.com/uploads/2026/10/29/20ab59a356a884498644cff73d47a13a.pdf","date":"2026-10-29"}],"evidenceTotal":6,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 31, 2026","url":"https://otx.alienvault.com/pulse/6ae4aefab0c2191cecd41862","created":"2026-10-30"},{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"}],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-rce-mORhqY4b","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20045","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: unauthenticated remote exploit of web management interface","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"could allow an unauthenticated, remote attacker to execute arbitrary commands","start":305,"end":382}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: arbitrary OS command execution after exploitation","mappingType":"primary_impact","evidence":[{"from":"description","quote":"execute arbitrary commands on the underlying operating system","start":356,"end":417}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-3600","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-3600","exploited":true,"exploitedSince":"2026-01-21","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-01-25","earliestUrl":"https://github.com/dkstar11q/Ashwesker-CVE-2026-20045","repos":[{"name":"dkstar11q/Ashwesker-CVE-2026-20045","url":"https://github.com/dkstar11q/Ashwesker-CVE-2026-20045","stars":7,"created":"2026-01-25"}]},"first":{"date":"2026-01-25","source":"PoC-in-GitHub","url":"https://github.com/dkstar11q/Ashwesker-CVE-2026-20045"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2026-01-21","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20045","provenance":"source"},{"date":"2026-01-21","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-rce-mORhqY4b","provenance":"source"},{"date":"2026-01-21","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-01-21","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-3600","provenance":"source"},{"date":"2026-01-25","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/dkstar11q/Ashwesker-CVE-2026-20045","provenance":"source"}],"speed":{"daysToPublicExploit":4,"firstExploitFrom":"PoC-in-GitHub","daysToKev":0},"priority":{"score":73.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 283 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.31,"detail":"percentile 0.9156"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}