Metraipolis › archive › dc_49ac81978deb

KEV CVE-2026-20230: Cisco Unified Communications Manager — Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability

Source: CISA KEV
Original: https://nvd.nist.gov/vuln/detail/CVE-2026-20230
License (as archived): CC0-1.0
Archived: 2026-10-07T11:51:52.189Z
SHA-256 of the archived text: d3087ee33822fb3f03d257a0f7d6fb33bf1dd6bc945ffb7c80e7b7d689cd852c
Stable URL of this page: https://metraipolis.com/documento/dc_49ac81978deb

How to cite

KEV CVE-2026-20230: Cisco Unified Communications Manager — Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability — CISA KEV, https://nvd.nist.gov/vuln/detail/CVE-2026-20230 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_49ac81978deb (Metraipolis archive dc_49ac81978deb, sha256 d3087ee33822fb3f03d257a0f7d6fb33bf1dd6bc945ffb7c80e7b7d689cd852c)

BibTeX

@misc{dc49ac81978deb,
  title = {KEV CVE-2026-20230: Cisco Unified Communications Manager — Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability},
  howpublished = {CISA KEV},
  url = {https://nvd.nist.gov/vuln/detail/CVE-2026-20230},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_49ac81978deb; sha256 d3087ee33822fb3f03d257a0f7d6fb33bf1dd6bc945ffb7c80e7b7d689cd852c},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: CISA KEV, https://nvd.nist.gov/vuln/detail/CVE-2026-20230. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

CVE-2026-20230 è nel catalogo CISA delle vulnerabilità SFRUTTATE attivamente (Known Exploited Vulnerabilities), aggiunta il 2026-06-25.
Prodotto: Cisco Unified Communications Manager — Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability
Descrizione: Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) Vulnerability that could allow an unauthenticated, remote attacker to write files to the underlying operating system that could be used later to elevate to root.
Azione richiesta (agenzie federali USA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Scadenza: 2026-06-28.
Uso noto in campagne ransomware: Unknown
Debolezze: CWE-918
Note e riferimenti: https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-cucm-ssrf-cXPnHcW.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-20230

Fonte: catalogo CISA KEV (CC0 1.0), versione 2026.10.04, consultato il 2026-10-07: https://www.cisa.gov/known-exploited-vulnerabilities-catalog