Cisco Patches Critical Zero-Day Vulnerability CVE-2026-20045 in Unified Communications

Cisco has addressed a critical-rated zero-day vulnerability, CVE-2026-20045, in its Unified Communications platforms, including Unified Communications Manager, Session Management Edition, IM & Presence Service, Cisco Unity Connection, and Webex Calling Dedicated Instance. This flaw allows unauthenticated remote attackers to execute arbitrary code on the underlying operating system, potentially leading to full system compromise.

The vulnerability was discovered in the web-management interfaces of these systems, specifically due to improper validation of user-supplied input in HTTP requests. Cisco’s Product Security Incident Response Team rated the vulnerability as ‘Critical,’ despite its CVSS base score being in the ‘High’ range, because of the potential for complete system exploitation.

Cisco has acknowledged that attempts to exploit this vulnerability are occurring in the wild, and it has urged customers to apply the patch immediately. The issue is particularly concerning as it affects management interfaces that are often accessible over internal networks or VPNs, making it a target for attackers.

This patch follows another recent emergency fix for a different critical vulnerability, CVE-2025-20393, in Cisco’s Secure Email Gateway and Secure Email and Web Manager products. This trend underscores ongoing security challenges for Cisco as it navigates multiple vulnerabilities early in the year.

CISA has included CVE-2026-20045 in its Known Exploited Vulnerabilities list, which mandates federal agencies to patch the flaw by a specific deadline. This inclusion serves as a strong reminder for all organizations to prioritize patching to mitigate risks associated with this vulnerability.

For organizations still treating voice infrastructure as low-risk, this incident highlights the evolving threat landscape where attackers are increasingly targeting communication systems. Ensuring timely updates and security measures is crucial to protect sensitive data and maintain operational integrity.

• Cisco Unified Communications Manager: Affected by CVE-2026-20045, allowing remote code execution.
• Session Management Edition: Vulnerable to the same critical flaw, enabling potential system compromise.
• IM & Presence Service: Included in the list of platforms affected by the zero-day vulnerability.
• Cisco Unity Connection: Also impacted, requiring immediate patching to mitigate risks.
• Webex Calling Dedicated Instance: Vulnerable to exploitation through the management interface.