Cisco has released Critical Updates to fix a significant security vulnerability affecting multiple Cisco Unified Communications products including Cisco Webex Calling Dedicated Instance (CID). This vulnerability is known as CVE-2026-20045 and has a CVSS 3.0 score of 8.2 which indicates that any unauthenticated usercould exploit this security hole to send commands to devices affected by this vulnerability.
This vulnerability stems from the manner in which Cisco processes input coming from users through the HTTP protocol; when users provide incorrect information through the HTTP protocol, they can create requests that could allow an attacker to gain access to that same management interface, potentially escalating their privileges to root access.
Currently, the affected products include:
1. Cisco Unified CM
2. Cisco Unified CM Session Management Edition (SME)
3. Cisco Unified CM IM and Presence (IM&P)
4. Cisco Unity Connection
5. Cisco Webex Calling Dedicated Instance (CID)
How to address this issue:
1. Cisco Release 12.5: Upgrade to a patched version
2. Cisco Release 14: Use either 14SU5 or the .cop.sha512 patch
3. Cisco Release 15: Use either 15SU4 or the .cop.sha512 patch
Cisco has publicly stated that this vulnerability is being exploited in the wild; therefore, organizations should make every effort to get their software updated now. As of now, there are no known workarounds available, and the United States Cybersecurity and Infrastructure Security Agency (CISA) has put this on their Known Exploited Vulnerabilities (KEV) database, requiring the federal government to apply patches by 2/11/2026 (a requirement for the Fed Government).
Cisco recently discovered a second Cisco vulnerability being actively exploited, AsyncOS Software, CVE-2025-20393, showing an increasing focus by attackers on Network and Collaboration tools.
In summary, the answer to your question is simple: patch as soon as you can. Any delay could put your systems at risk of exploitation by cybercriminals.
Source: The Hacker News
