Cisco Unified CM CVE-2026-20230

The WebDialer service on Cisco Unified CM or Unified CM SME must be enabled; Cisco states WebDialer is disabled by default, so only clusters where an administrator has explicitly turned on the click-to-call service are exploitable. The attacker must additionally have network reachability to the WebDialer HTTP endpoint on the Unified CM management or application interface. Beyond those, no authentication, no user interaction, and no privileges are required per CVSS PR:N/UI:N/AC:L, so once WebDialer is enabled and reachable, exploitation is unauthenticated and low-complexity. Achieving root (the Critical-rated outcome) requires the attacker to chain the file-write primitive into a local escalation step on the Unified CM OS, which Cisco describes as feasible but is a second stage rather than an immediate consequence of the SSRF.

Signals point in different directions and require careful interpretation. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N rates the immediate primitive as network-reachable, low-complexity, unauthenticated, scope-changed integrity impact only - yielding 8.6 (High). Cisco explicitly overrides this to Critical SIR because the file-write primitive enables privilege elevation to root on the underlying OS, a downstream impact CVSS does not capture. EPSS and CISA KEV data were not provided in the input, so exploitation-probability and active-exploitation signals are not independently confirmable; no public exploit identified at time of analysis. The most important risk-limiting factor is configuration: WebDialer is disabled by default, so only deployments that have explicitly enabled click-to-call functionality are exposed - likely a minority of installations, biased toward enterprises with CTI/contact-center integrations. Net assessment: high priority for any organization running WebDialer, lower urgency for default deployments, but the vendor's Critical rating and root-escalation pathway justify expedited patching even where WebDialer status is uncertain.

An attacker on a network segment that can reach the Unified CM WebDialer HTTP interface sends a crafted HTTP request that abuses the SSRF/input-validation flaw to write a controlled file onto the Unified CM appliance's filesystem. The attacker then chains that file-write into a follow-on local privilege escalation - for example by dropping a payload into a path consumed by a root-owned service - to obtain root on the Unified CM host. No public exploit code is identified at time of analysis, but the low attack complexity and lack of authentication mean any reachable WebDialer-enabled cluster is a viable target once a PoC emerges.