Historical catalog analysis: CISA added this entry on January 21, 2026. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.
What the vulnerability is
CVE-2026-20045 is a code injection vulnerability (CWE-94) affecting several Cisco Unified Communications products. The flaw allows an attacker to potentially gain user-level access to the underlying operating system of the affected device. Once initial access is established, the attacker may be able to elevate their privileges to root level.
Exposure and applicability
This vulnerability applies to organizations deploying the following Cisco products:
* Cisco Unified Communications Manager (Unified CM)
* Cisco Unified Communications Manager Session Management Edition (Unified CM SME)
* Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P)
* Cisco Unity Connection
* Cisco Webex Calling Dedicated Instance
Infrastructure owners should identify all instances of these services within their environment to determine the total attack surface. The risk is highest for systems exposed to untrusted networks where an attacker could initiate the code injection.
Remediation priorities
Based on our analysis, vulnerability management teams should prioritize remediation based on the following hierarchy:
- Immediate Patching: Apply mitigations and updates according to the vendor’s specific instructions for each affected product version.
- Cloud Service Alignment: For organizations utilizing cloud-based deployments of these services, follow applicable BOD 22-01 guidance to ensure service providers have addressed the exposure.
- Decommissioning: If mitigations are unavailable for a specific legacy version or deployment, our analysis suggests discontinuing use of the product to eliminate the risk.
How to validate remediation
To verify that exposure has been reduced, defenders should move beyond simple version checks. While confirming a patched version is installed is a necessary first step, it does not prove the vulnerability is unreachable in a specific configuration.
Validation should include:
* Configuration Audit: Verifying that the vendor-recommended mitigations are active and correctly configured across all identified assets.
* Access Control Review: Confirming that network segmentation limits access to the management interfaces of these products, reducing the likelihood of an external attacker reaching the injection point.
Limits and open questions
Applying a patch or mitigation could reduce the likelihood of exploitation, but it may not eliminate all residual risk associated with the underlying operating system’s privilege model. It remains unknown whether this vulnerability has been utilized in ransomware campaigns. Additionally, while CISA has established a deadline for federal agencies, non-federal organizations must determine their own remediation timelines based on their specific risk tolerance and asset criticality.
Source and editorial note
CVE-2026-20045: Cisco Unified Communications Products Code Injection Vulnerability · Source date: January 21, 2026 · Retrieved August 31, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Archive date: January 24, 2026. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 23, 2026 at 00:36 UTC.
Request a Vulnerability Assessment
Turn security intelligence into action.
Discuss your exposure, priorities, and the evidence needed to validate the outcome.
Request a security assessment ↗