Cisco Confirms In-the-Wild Exploitation of Unified CM Vulnerability

A PoC exploit has been available since public disclosure, and the first exploitation attempts were observed last week. The post Cisco Confirms In-the-Wild Exploitation of Unified CM Vulnerability appeared first on SecurityWeek .

SecurityWeek reports that Cisco Unified Communications Manager and Unified CM SME are impacted by CVE-2026-20230, a high‑severity SSRF/file‑write flaw in the WebDialer service that now has a public PoC and confirmed in‑the‑wild exploitation attempts, with potential for root‑level compromise of voice infrastructure.[3][4][5][9] Cisco has released fixes and recommends immediate patching or disabling WebDialer while researchers and CISA have added the bug to exploited‑vulnerability tracking, underscoring the risk to enterprise communications systems.[3][5][6] From a CyberSE.AI perspective, any AI agents or workflows that depend on Cisco Unified CM as part of their communication or automation stack inherit this infrastructure risk, so organizations should treat UCM as a critical component in their AI supply chain and ensure patch/status tracking in SBOMs and AI system inventories. Hardening and continuous monitoring of Unified CM, coupled with supply‑chain‑aware threat modeling for AI agents that integrate with telephony or collaboration platforms, can reduce the chance that a compromised communications manager becomes a pivot point for broader AI system abuse or data leakage.