InfoSecBulletin Cybersecurity for mankind
A serious SSRF flaw, called CVE-2026-20230, in Cisco Unified Communications Manager Server is now being used in attacks. Cisco put out security updates for the CVE-2026-20230 flaw on June 3. They warned that attackers could gain full control of the device.
“A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device,” warned Cisco.
Apple Warns 99 Countries iPhone Users of Mercenary Spyware Attacks
Daily Cyber security update for 31.10. 2026
NetamLoader malware to attack Win10: Customized for Gov.t in Asia
‘SMS of Death’ Zero-Click Flaw Disrupting Android Phones With a Single Text
NIST Unveiled Guidance for Post-Quantum Cryptography Transition
Daily Cyber security update for 29.10. 2026
Rapid7 Unveils 17 Zimbra Collaboration Suite Flaws Breaking Identity Boundaries
CISA launched two free tools Identify Security Misconfig in Microsoft 365 and Google Workspace
Apple iOS 27.2 Released Fixes 163 Flaws, Including Critical WebKit RCE
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
The flaw was disclosed to Cisco by SSD Secure, who did not share any technical details at the time. Now, threat intelligence firm Defused warned that the flaw is now being actively exploited in attacks.
“Over the weekend we observed exploitation of CVE-2026-20230 – Cisco Unified CM (CUCM) WebDialer SSRF → root file-write (CVSS 8.6) No previously recorded exploitation, and not yet listed in CISA KEV,” Defused warned on X.
Defused says the attacks come from one IP address and use special file:// codes to make files on the device.
The flaw can be used in attacks to place webshells and get root access, but the example seen by Defused seems made to find weak devices by trying to save a text file called ‘/tmp/cve-2026-20230-test.txt’ on them.
After the problem was revealed, SSD Secure released a technical document about the issue. It explained how the weakness works and included a test example of the exploit.
The researchers discovered that a hacker without permission could misuse the Webdialer feature’s management of user URLs. This allows them to make the app write random files to the system using file:// links.
