Assessment
Why it matters
CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 83.2%; technical severity is CVSS 8.6.
A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root. Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root. Note: To exploit this vulnerability, the WebDialer service must be enabled. WebDialer is disabled by default.
Who should care
- Teams operating Unified Communications Manager
- Vulnerability and exposure management teams
- Security operations teams monitoring exploitation activity
Response plan
What I would do
- Confirm whether Unified Communications Manager is present in the environment.
- Identify affected versions and establish whether vulnerable services are exposed or reachable.
- Cisco Security advisory Cisco Sa Cucm Ssrf CXPnHcW
- Review relevant security telemetry for evidence of attempted or successful exploitation.
- Document the remediation decision and track it to verified completion.
Treatment intelligence
Remediation intelligence
Vendor sources are listed before government and third-party guidance. Confirm product applicability and change prerequisites before deployment.
Advisory
Technical details
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
- CWE
- CWE-918
- Affected versions
- Cisco Unified Communications Manager (Start Including 14.0, End Excluding 14su6 | Start Including 14.0, End Excluding 14su6 | Start Including 15.0, End Including 15su4a | Start Including 15.0, End Including 15su4a)
- Fixed versions
- Cisco Unified Communications Manager (Fixed from 14su6)
- Published
- 3 June 2026
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
Signal timeline
- CVE published
- Added to CISA KEV
- Latest EPSS score: 83.2%
- Signal calculated at 82