{"id":10052,"date":"2026-01-22T10:04:29","date_gmt":"2026-01-22T10:04:29","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/01\/22\/cisco-unified-communications-0-day-rce-vulnerability-exploited-in-the-wild-to-gain-root-access\/"},"modified":"2026-01-22T10:04:29","modified_gmt":"2026-01-22T10:04:29","slug":"cisco-unified-communications-0-day-rce-vulnerability-exploited-in-the-wild-to-gain-root-access","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/01\/22\/cisco-unified-communications-0-day-rce-vulnerability-exploited-in-the-wild-to-gain-root-access\/","title":{"rendered":"Cisco Unified Communications 0-day RCE Vulnerability Exploited in the Wild to Gain Root Access"},"content":{"rendered":"

Cisco Unified Communications 0-day RCE Vulnerability Exploited in the Wild to Gain Root Access
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Cisco has disclosed a critical zero-day remote code execution (RCE) vulnerability, CVE-2026-20045, actively exploited in the wild.<\/p>\n

Affecting key Unified Communications products, this flaw allows unauthenticated attackers to run arbitrary commands on the underlying OS, potentially gaining root access.<\/p>\n

The Cisco Product Security Incident Response Team (PSIRT) confirmed exploitation attempts and urged immediate patching.<\/p>\n

The issue stems from improper validation of user-supplied input in HTTP requests to the web-based management interface. An attacker sends crafted HTTP requests that bypass authentication<\/a>, execute commands at the user level, and then escalate privileges to root. Cisco rated it Critical via Security Impact Rating (SIR), overriding the CVSS score due to root-level risks.<\/p>\n

No workarounds exist. Exploitation requires network access to the management interface, common in enterprise VoIP setups exposed via firewalls or VPNs.<\/p>\n

Affected Products<\/strong><\/h2>\n

This vulnerability impacts these Cisco products regardless of configuration:<\/p>\n

\n\n\n\n\n\n\n\n\n\n
Product<\/th>\nBug ID<\/th>\n<\/tr>\n<\/thead>\n
Unified CM<\/td>\nCSCwr21851<\/td>\n<\/tr>\n
Unified CM SME<\/td>\nCSCwr21851<\/td>\n<\/tr>\n
Unified CM IM&P<\/td>\nCSCwr29216<\/td>\n<\/tr>\n
Unity Connection<\/td>\nCSCwr29208<\/td>\n<\/tr>\n
Webex Calling Dedicated Instance<\/td>\nCSCwr21851<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

Products like Contact Center SIP Proxy, Unified CCE, and others are confirmed unaffected. Check the advisory<\/a> for full details.<\/p>\n

Fixed Releases and Patches<\/strong><\/h2>\n

Cisco released updates and patches<\/a>. Migrate or apply version-specific fixes; consult patch READMEs.<\/p>\n

Unified CM, IM&P, SME, Webex Calling<\/strong><\/h3>\n
\n\n\n\n\n\n\n\n
Release<\/th>\nFirst Fixed Release<\/th>\n<\/tr>\n<\/thead>\n
12.5<\/td>\nMigrate to fixed release<\/td>\n<\/tr>\n
14<\/td>\n14SU5 or 14SU4a patch<\/a>\n<\/td>\n<\/tr>\n
15<\/td>\n15SU4 (Mar 2026) or 15SU2\/3 patches<\/a>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

Unity Connection<\/strong><\/h3>\n
\n\n\n\n\n\n\n\n
Release<\/th>\nFirst Fixed Release<\/th>\n<\/tr>\n<\/thead>\n
12.5<\/td>\nMigrate to fixed release<\/td>\n<\/tr>\n
14<\/td>\n14SU5 or 14SU4 patch<\/a>\n<\/td>\n<\/tr>\n
15<\/td>\n15SU4 (Mar 2026) or 15SU3 patch<\/a>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

PSIRT validates only listed releases.<\/p>\n

Exploitation in the Wild<\/strong><\/h2>\n

Cisco PSIRT detected real-world exploits targeting unpatched systems. Attackers likely leverage automated scanners for exposed interfaces. Enterprises running vulnerable VoIP\/UC deployments face high risk, especially in hybrid work environments.<\/p>\n

Apply patches immediately. Restrict management interface to trusted IPs via firewalls. Monitor logs for anomalous HTTP requests. CISA added<\/a> this to the Known Exploited Vulnerabilities soon.<\/p>\n

An external researcher reported the flaw; Cisco credited them in the advisory. Stay vigilant: zero-day vulnerabilities like CVE-2026-20045 underscore UC platform risks amid rising RCE trends.<\/p>\n

Follow us on Google News<\/a>, LinkedIn<\/a>, and X<\/a> for daily cybersecurity updates. Contact us<\/a> to feature your stories.<\/strong><\/p>\n

The post Cisco Unified Communications 0-day RCE Vulnerability Exploited in the Wild to Gain Root Access<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Guru Baran
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Cisco Unified Communications 0-day RCE Vulnerability Exploited in the Wild to Gain Root Access Cisco has disclosed a critical zero-day remote code execution (RCE) vulnerability, CVE-2026-20045, actively exploited in the wild. Affecting key Unified Communications products, this flaw allows unauthenticated attackers to run arbitrary commands on the underlying OS, potentially gaining root access. The Cisco […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,131,648],"tags":[130],"class_list":["post-10052","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-vulnerability","category-vulnerability-news","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/10052"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=10052"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/10052\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=10052"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=10052"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=10052"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}