CVE-2026-20045 (cisco-sa-voice-rce-mORhqY4b) is a Critical-rated vulnerability, CVSS base 8.2, in the web management interface of Unified CM, SME, IM and Presence, Unity Connection and Webex Calling Dedicated Instance. An unauthenticated attacker can gain OS access and escalate to root.

Checked 2026-09-30

Vendor: Cisco
Product: Unified Communications Manager
Subsystem: security
Deployment: on-premises, dedicated-instance
Region: not restricted
Release range: 12.5 / 14 / 15 before fixed releases
Checked: 2026-09-30

Sources

Cisco Unified Communications Products Remote Code Execution Vulnerability — Cisco PSIRT · tier 2 current vendor documentation · Summary; Affected Products

Cite this note

APA

WarmTransfer. (2026, September 30). Cisco unified cm: source note cisco-unified-cm-rce-cve-2026-20045. WarmTransfer. https://warmtransfer.net/knowledge/claims/cisco-unified-cm-rce-cve-2026-20045

BibTeX

@misc{warmtransfer-claim-cisco-unified-cm-rce-cve-2026-20045,
  title  = {Cisco unified cm: source note cisco-unified-cm-rce-cve-2026-20045},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/claims/cisco-unified-cm-rce-cve-2026-20045},
  note   = {Source note cisco-unified-cm-rce-cve-2026-20045, checked 2026-09-30}
}

Read in context