CVE · Exploited · On CISA KEV

CVE-2026-20045

Cisco Unified Communications Products Code Injection Vulnerability

9.8: CVSS 3.1
1: story
JAN 21: added to KEV

Severity: 9.8 Critical · NVD score
Vendor: Cisco
Product: Unified Communications Manager
Published: Jan 21, 2026
Added to KEV: Jan 21, 2026
KEV deadline: Feb 11, 2026
Ransomware use: Unknown
Weakness: CWE-94

What it is

Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance contain a code injection vulnerability that could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑

JAN 22
VulnerabilitiesCisco Fixes Unified Communications RCE Flaw Under AttackThreat actors are attempting to exploit the Cisco remote code execution flaw (CVE-2026-20045) in the wild, according to a new security advisory.DECIPHER · 2 MIN

Official references

4 sources

Registries

RegistryNVDScore, weakness and every reference RegistryCVE.orgThe official CVE record RegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisorysec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-rce-mORhqY4b