[CVE-2026-20230]

July 13, 2026

• A pre-auth RCE path in Cisco Unified CM (CVE-2026-20230) turns the phone system into a foothold. The WebDialer SSRF allows unauthenticated code execution via crafted SOAP requests and cluster-wide persistence; the researcher notes current patches only add URI filtering while other weaknesses remain (SecureLayer7). · Vulnerabilities & Exploits

in Russian Intelligence Turns IP Cameras and Routers Into a NATO Surveillance Grid

June 25, 2026

• Cisco Unified Communications Manager SSRF flaw CVE-2026-20230 (CVSS 8.6) is being exploited after a public PoC chained the unauthenticated SSRF into a file-write primitive leading to root-level compromise. Horizon3, The Hacker News · Vulnerabilities & Exploits

in Cisco SD-WAN Manager Zero-Day Gives Root via a Malicious CSV as Operation Endgame Smashes Amadey and StealC

June 24, 2026

• CVE-2026-20230, a high-severity SSRF in Cisco Unified Communications Manager, is now exploited in the wild; a PoC was already public when Cisco shipped patches in early June. BleepingComputer, SecurityWeek. · Vulnerabilities & Exploits

in Two Netlogon Flaws Hit Domain Controllers as FortiBleed Lands in Finland