WaratekVRT Sign in

CVE-2026-20045

Affected software3 products, listed below
Severity9.8 Critical CVSS 3.1 2 scores
WeaknessCode injection (CWE-94)
Published21 Jan 2026
Updated17 Jun 2026

Description

A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device.  This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root.  Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2026-01-21 · remediation due 2026-02-11 · ransomware use: unknown
  • VulnCheck KEV listed Exploitation reported in the wild. 7 citations · 1 exploit · earliest 2026-01-21.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
  • Indexed PoC 1 indexed Published artifacts you can open, in GitHub PoC; first seen 2026-01-25.
  • EPSS 4.5% chance in 30 days

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2026-20045 in VulnCheck (free account), which lists 2 more citations not shown here.

EvidenceSourceDetailDate
Reported exploitation sec.cloudapps.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-rce-mORhqY4b 2026-01-21
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2026-01-21
Reported exploitation viz.greynoise.io /tags/cisco-unified-communications-manager-input-validation-cve-2026-20045-rce-attempt?days=1 2026-01-22
Reported exploitation recordedfuture.com /blog/january-2026-cve-landscape 2026-02-24
Reported exploitation cyble.com /reports/H1-2026-Global-Threat-Landscape-Report.pdf 2026-07-27
Exploit reference VulnCheck XDB df0cc2bf078c Exploit type: initial-access 2026-01-25
IndexArtifactStarsFirst seen
GitHub PoC CVE-2026-20045 6 2026-01-25

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review automated Upstream data
  • Record active
Decided by The only affected product being a sealed appliance image, where Java runs but no -javaagent can be attached
Finding This CVE names only products the Waratek agent cannot be installed into (cisco/unified_communications_manager, cisco/unified_communications_manager_im_and_presence_service, cisco/unity_connection). They ship as sealed appliance images or as native code with no application JVM, so there is no start-up line to add -javaagent to. The vulnerability may well be a Java one; it is permanently out of ARMR's reach rather than outside its subject.

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 3.1 8.2 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N psirt@cisco.com Secondary

Affected software and releases

Products and versions

3 products, 6 version entries
SourceVendorProductSchemeAffected versions
nvd cisco unified communications manager generic ≥ 12.5 and ＜ 14.5 · ≥ 15.0 and ≤ 15.3
nvd cisco unified communications manager im and presence service generic ≥ 12.5 and ＜ 14.5 · ≥ 15.0 and ≤ 15.3
nvd cisco unity connection generic ≥ 12.5 and ＜ 14.5 · ≥ 15.0 and ≤ 15.3

References

URLTags
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-rce-mORhqY4b
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-20045 US Government Resource

Timeline
Published2026-01-21By the CVE Program.
Added to CISA KEV2026-01-21Listed in CISA's Known Exploited Vulnerabilities catalog.
VulnCheck KEV: earliest evidence2026-01-21Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
NVD record modified2026-06-17NVD's own last-modified date for this record.
VulnCheck KEV: latest evidence2026-10-29Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.