Summary

• A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device.

  This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to write files to the underlying operating system that could be used later to elevate to root.

  Note: Cisco has assigned this security advisory a Security Impact Rating (SIR) of Critical rather than High as the score indicates. The reason is that exploitation of this vulnerability could result in an attacker elevating privileges to root.

  Note: To exploit this vulnerability, the WebDialer service must be enabled. WebDialer is disabled by default.

  Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

  This advisory is available at the following link:
  https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW

Affected Products

• Vulnerable Products

  This vulnerability affects Cisco Unified CM and Unified CM SME if they have the WebDialer service enabled.

  For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory.

  Determine Whether WebDialer Is Enabled

  To determine whether WebDialer is enabled, complete the following steps:

  1. Log in to the Cisco Unified CM Administration interface.
  2. From the Navigation menu, choose Cisco Unified Serviceability and click Go.
  3. From the Tools menu, choose Control Center - Feature Services.
  4. In the CTI Services section of the page, check whether the current status of the Cisco WebDialer Web Service is Started or Not Running.

  If the status is Started, WebDialer is enabled.

  Products Confirmed Not Vulnerable

  Only products listed in the Vulnerable Products section of this advisory are known to be affected by this vulnerability.

Workarounds

• There are no workarounds that address this vulnerability. However, as a mitigation, administrators may disable the WebDialer service until a patch can be applied.

  To disable WebDialer, complete the following steps:

  1. Log in to the Cisco Unified CM Administration interface.
  2. From the Navigation menu, choose Cisco Unified Serviceability and click Go.
  3. From the Tools menu, choose Service Activation.
  4. In the CTI Services section of the page, uncheck the Cisco WebDialer Web Service check box and click Save.

  While this mitigation has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment.

Fixed Software

• Cisco considers any workarounds and mitigations (if applicable) to be temporary solutions until an upgrade to a fixed software release is available. To fully remediate this vulnerability and avoid future exposure as described in this advisory, Cisco strongly recommends that customers upgrade to the fixed software indicated in this advisory.

  Fixed Releases

  In the following table, the left column lists Cisco software releases. The right column indicates whether a release is affected by the vulnerability that is described in this advisory and the first release that includes the fix for this vulnerability. Customers are advised to upgrade to an appropriate fixed software release as indicated in this section.

  Cisco Unified CM and Unified CM SME Release	First Fixed Release
  14	14SU6
  15	15SU5 (Sep 2026) or COP1

  1. Patches are version-specific. Consult the README attached to the patch for details.

  The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory.

Exploitation and Public Announcements

• The Cisco PSIRT is aware that proof-of-concept exploit code is available for the vulnerability that is described in this advisory.

  In June 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability. Cisco continues to strongly recommend that customers upgrade to a fixed software release to remediate this vulnerability.

Source

• Cisco would like to thank an independent security researcher working with SSD Secure Disclosure for reporting this vulnerability.

URL

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW

Revision History

• Version	Description	Section	Status	Date
  1.1	Added information about active exploitation.	Exploitation and Public Announcements	Final	2026-JUL-01
  1.0	Initial public release.	-	Final	2026-JUN-03

  Show Less