Cisco Unified Communications Manager WebDialer SSRF to File Write and Root Privilege Escalation
CVE-2026-20230 is a critical server-side request forgery vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME). The flaw is caused by improper input validation of specific HTTP requests in the WebDialer component/service. An unauthenticated remote attacker can send crafted HTTP requests to an affected system and trigger SSRF against internal services. Cisco states that successful exploitation can allow the attacker to write files to the underlying operating system; those files can then be used in subsequent stages to escalate privileges to root. Supporting reporting also indicates public proof-of-concept exploit code exists and that observed exploit chains have used the SSRF condition to reach internal services and drop JSP webshells, leading to remote code execution on the underlying server.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Repository contains a single Python PoC exploit and a README describing the attack chain and defensive considerations. The main file, CVE-2026-20230-poc.py, is a standalone command-line exploit that targets Cisco CUCM by chaining unauthenticated web access, hostname discovery from WebDialer WSDL, SSRF through the cmplatform install status endpoint, Axis service abuse, arbitrary file write, and final JSP-based command execution. The exploit is structured as a staged workflow: get_hostname() retrieves the real internal hostname from /webdialer/Version.jws?wsdl; ssrf_create_axis_service() sends a crafted request to /cmplatform/installClusterStatusExecute with a doubly encoded Axis deployment descriptor that creates a service named randomR11 and abuses org.apache.axis.handlers.LogHandler to write aaa.jsp into the Tomcat axis2-web directory; later stages verify the service, write an initial JSP dropper, write a second JSP command shell (c.jsp), and execute an operator-supplied command such as id. The script supports a --check mode, target/port selection, and command selection, indicating practical exploit intent rather than mere detection. The README is extensive and mostly explanatory, covering prerequisites such as WebDialer needing to be enabled, affected product context, attack-chain rationale, detection opportunities, and mitigation guidance. Overall, this is a real operational PoC for unauthenticated SSRF-to-arbitrary-file-write-to-RCE against CUCM, not just a scanner or documentation-only repository.
Small single-script Python repository containing a Cisco Unified CM CVE-2026-20230 scanner and PoC tester. Repository structure is minimal: one executable Python script, a README, dependency file, license, and .gitignore. The main script uses requests, urllib3, argparse, and colorama. Core capabilities: 1) Recon/fingerprinting: scan_target() sends GET requests to several Cisco Unified CM-related paths (/webdialer/Webdialer, /webdialer/Cisco_WebDialer_Service, /ccmadmin/showHome.do, /login.jsp, /cmplatform/, /cucm-uds/) and looks for response markers such as 'cucm', 'unified cm', 'webdialer', and version-like strings '14.'/'15.'. 2) Service detection: check_webdialer() probes likely WebDialer endpoints and flags the service as enabled when HTTP 200/403 responses contain WebDialer-related strings. 3) PoC testing: test_poc() submits a POST request to /webdialer/Webdialer with form fields dest and url set to file:// URIs, attempting to trigger a file-write primitive to an arbitrary path on the target. Success is inferred heuristically from status codes or response keywords. Important limitations: the script itself labels the POST body as a placeholder and explicitly says to replace it with real PoC parameters. Therefore, while it is exploit-oriented and includes an active write-test routine, it is not a complete weaponized exploit and does not contain a verified end-to-end root compromise chain. It is best characterized as an operational scanner/PoC harness rather than a polished exploit framework. No external hardcoded C2 or callback infrastructure is present. All network activity is direct client-to-target HTTP(S) requests. TLS verification is disabled, which helps against self-signed CUCM deployments. The script is interactive by default but supports automated PoC execution with --poc and a custom target file path via --file.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
208 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical SSRF vulnerability in Cisco Unified Communications Manager and Unified CM SME that can let an unauthenticated attacker interact with internal services and potentially write files that could later be used to escalate privileges to root.
A critical unauthenticated SSRF vulnerability in Cisco Unified Communications Manager that can be exploited remotely and may allow arbitrary file write to the underlying operating system, potentially enabling privilege escalation to root and full host compromise.
A server-side request forgery vulnerability in Cisco Unified Communications Manager WebDialer that allows an unauthenticated remote attacker to write files to the underlying OS, enabling later escalation to root.
A critical server-side request forgery vulnerability in Cisco Unified Communications Manager Server that can be exploited remotely and without authentication via specially crafted HTTP requests.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.