{"id":180470,"date":"2026-01-21T23:06:00","date_gmt":"2026-01-22T04:06:00","guid":{"rendered":"https:\/\/testing.news-you-need.com\/index.php\/2026\/01\/21\/cisco-fixes-actively-exploited-zero-day-cve-2026-20045-in-unified-cm-and-webex\/"},"modified":"2026-01-22T01:20:11","modified_gmt":"2026-01-22T06:20:11","slug":"cisco-fixes-actively-exploited-zero-day-cve-2026-20045-in-unified-cm-and-webex","status":"publish","type":"post","link":"https:\/\/testing.news-you-need.com\/index.php\/2026\/01\/21\/cisco-fixes-actively-exploited-zero-day-cve-2026-20045-in-unified-cm-and-webex\/","title":{"rendered":"Cisco Fixes Actively Exploited Zero-Day CVE-2026-20045 in Unified CM and Webex"},"content":{"rendered":"

Cisco Fixes Actively Exploited Zero-Day CVE-2026-20045 in Unified CM and Webex<\/a><\/p>\n

https:\/\/thehackernews.com\/2026\/01\/cisco-fixes-actively-exploited-zero-day.html<\/a><\/p>\n

Publish Date: 2026-01-21 23:06:00<\/a><\/p>\n

Source Domain: thehackernews.com<\/a><\/p>\n

Author: <\/a><\/p>\n

Using an unordered list, summarize the following article with between 4 and 8 key points.
\n\ue804Ravie Lakshmanan\ue802Jan 22, 2026Vulnerability \/ Zero-Day
\nCisco has released fresh patches to address what it described as a “critical” security vulnerability impacting multiple Unified Communications (CM) products and Webex Calling Dedicated Instance that it has been actively exploited as a zero-day in the wild.
\nThe vulnerability, CVE-2026-20045 (CVSS score: 8.2), could permit an unauthenticated remote attacker to execute arbitrary commands on the underlying operating system of a susceptible device.
\n“This vulnerability is due to improper validation of user-supplied input in HTTP requests,” Cisco said in an advisory. “An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root.”<\/p>\n

The critical rating for the flaw is due to the fact that its exploitation could allow for privilege escalation to root, it added. The vulnerability impacts the following products –<\/p>\n

Unified CM
\nUnified CM Session Management Edition (SME)
\nUnified CM IM & Presence Service (IM&P)
\nUnity Connection
\nWebex Calling Dedicated Instance<\/p>\n

It has been addressed in the following versions –
\nCisco Unified CM, CM SME, CM IM&P, and Webex Calling Dedicated Instance –<\/p>\n

Release 12.5 – Migrate to a fixed release
\nRelease 14 – 14SU5 or apply patch file: ciscocm.V14SU4a_CSCwr21851_remote_code_v1.cop.sha512
\nRelease 15 – 15SU4 (Mar 2026) or apply patch file: ciscocm.V15SU2_CSCwr21851_remote_code_v1.cop.sha512 or ciscocm.V15SU3_CSCwr21851_remote_code_v1.cop.sha512<\/p>\n

Cisco Unity Connection <\/p>\n

Release 12.5 – Migrate to a fixed release
\nRelease 14 – 14SU5 or apply patch file: ciscocm.cuc.CSCwr29208_C0266-1.cop.sha512
\nRelease 15 – 15SU4 (Mar 2026) or apply patch file: ciscocm.cuc.CSCwr29208_C0266-1.cop.sha512<\/p>\n

The networking equipment major also said it’s “aware of attempted exploitation of this vulnerability in the wild,” urging customers to upgrade to a fixed software release to address the issue. There are currently no workarounds. An anonymous external researcher has been credited with discovering and reporting the bug.
\nThe development has prompted the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add CVE-2026-20045 to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by February 11, 2026.
\nThe discovery of CVE-2026-20045 comes less than a week after Cisco released updates for another actively exploited critical security vulnerability affecting AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager (CVE-2025-20393, CVSS score: 10.0) that could permit an attacker to execute arbitrary commands with root privileges.<\/p>\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

Cisco Fixes Actively Exploited Zero-Day CVE-2026-20045 in Unified CM and Webex https:\/\/thehackernews.com\/2026\/01\/cisco-fixes-actively-exploited-zero-day.html Publish Date: 2026-01-21…<\/p>\n","protected":false},"author":1,"featured_media":180471,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhHOCMXq3WVtmcL9apl3XWrlOoAeRxJ2kZf_37YNtvg2oaO5wVX4zD-vOckg8TzcAeNUDKe0CpwaIvMz_9RQ0Lx-2sD5Jdz4rF7TxN74zZdq6lWOzfF3PdsYvmUy9CDqB9MxFV1leIxvXTuYYajixMcaQJLFGLGsLyfX7wdp9hkENDvdJqW6Y_hRlT6PnBk\/s1600-e365\/cisco-patch.jpg","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[24,31,27],"class_list":["post-180470","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-cybersecurity","tag-exploit","tag-vulnerability"],"_links":{"self":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/180470"}],"collection":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=180470"}],"version-history":[{"count":1,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/180470\/revisions"}],"predecessor-version":[{"id":180472,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/180470\/revisions\/180472"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/180471"}],"wp:attachment":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=180470"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=180470"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=180470"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}