US EditionCisco Plugs up Unified Comms Zero-Day Under Active Exploit
Cisco urges immediate patching of a critical flaw allowing root access; the U.S. agency mandated federal updates by Feb. 11, 2026, amid active exploitation attempts.
- On Wednesday, Cisco announced a fix for CVE-2026-20045, releasing version-specific patches for Cisco Unified Communications Manager, Unified CM IM & Presence, Unified CM SME, Cisco Unity Connection, and Webex Calling Dedicated Instance.
- In the web-based management interface, the bug sits in HTTP handling and can be triggered without logging in by crafted HTTP requests, allowing unauthenticated remote attackers to execute code and escalate to root.
- Cisco's Product Security Incident Response Team said attempts to exploit the flaw have been observed in the wild, with no workarounds available and customers urged to install updates soon.
- CISA added the flaw to its Known Exploited Vulnerabilities catalog and gave federal agencies until February 11, 2026 to deploy updates, raising the issue to emergency priority.
- Cisco assigned a Critical severity despite a CVSS score of 8.2, and this patch follows earlier fixes to Identity Services Engine and AsyncOS earlier this month, highlighting risks to voice infrastructure.
11 Articles
11 Articles
Cisco Patches Zero-Day Flaws Amid Chinese Hacker Exploits in 2026
Unmasking the Shadows: Cisco’s Battle Against Relentless Zero-Day Assaults in 2026 In the high-stakes world of cybersecurity, where digital fortresses guard the lifeblood of global enterprises, Cisco Systems Inc. finds itself once again at the epicenter of a sophisticated hacking saga. As of January 2026, the networking giant has been grappling with a series of zero-day vulnerabilities that have allowed attackers to breach critical systems, exec…
Cisco fixes a critical vulnerability that allows remote code execution for remote attackers to access root privileges. The network provider provides updates for the affected unified communications solutions.
CISA Warns Of Cisco Unified CM 0-Day RCE Vulnerability Exploited In Attacks - Cybernoz - Cybersecurity News
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert after confirming active exploitation of a zero-day remote code execution (RCE) vulnerability in multiple Cisco Unified Communications products. Tracked as CVE-2026-20045, the flaw enables code injection attacks that grant attackers user-level access to the underlying OS, followed by full root privilege escalation. Added to CISA’s Known Exploited Vulnerabi…
Admins need to act quickly. Cisco warns against attempts to attack a vulnerability in unified communications products.
Coverage Details
Bias Distribution
- 100% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
