Security advisories

Cisco Discloses Zero-Day Vulnerability (CVE-2026-20045)

January 22, 2026 | 2 MINS READ

Speak With A Security Expert Now

TALK TO AN EXPERT

THE THREAT

On January 21st, 2026, Cisco published an advisory for CVE-2026-20045 (CVSS: 8.2), a zero-day Remote Code Execution (RCE) vulnerability. The following Cisco products are impacted:

Successful exploitation of CVE-2026-20045 can allow attackers to obtain user-level access to the underlying operating system, and execute arbitrary commands on the impacted device, leading to privilege elevation or malware deployment. Cisco confirmed that they are aware of exploitation attempts targeting CVE-2026-20045. The company has released security patches to address this vulnerability. As exploitation is ongoing, it is critical that organizations apply the relevant security patches immediately.

What we're doing about it

What you should do about it

Additional information

CVE-2026-20045 stems from the improper validation of user-supplied input within HTTP requests, with exploitation involving threat actors sending specially crafted HTTP requests to the web-based management interface on affected devices. Although the CVSS score for the vulnerability identifies it as High severity, Cisco labels the vulnerability as Critical within their Security Impact Rating (SIR), due to successful exploitation allowing threat actors to elevate privileges to root.

Following Cisco's disclosure, CISA added CVE-2026-20045 to its Known Exploited Vulnerabilities (KEV) catalog, signaling that exploitation has been confirmed. The addition to the KEV also provides federal agencies with a deadline of February 11th, 2026, to apply relevant patches. Neither CISA nor Cisco provide any additional information or context on the observed exploitation of CVE-2026-20045. Technical details on the vulnerability are limited, and at the time of writing, Proof-of-Concept (PoC) exploit code has not been published, but this can rapidly change. Given the severity of the vulnerability and reports of ongoing exploitation, organizations that utilize the impacted software should prioritize patching immediately.

CVE-2026-20045 Impacted Product List
Unified CM, Unified CM IM&P, Unified CM SME, and Webex Calling Dedicated Instance
Cisco Unified CM, Unified CM IM&P, Unified CM SME, and Webex Calling Dedicated Instance Release First Fixed Release
12.5 Migrate to a fixed release
14 14SU5 or apply patch file
ciscocm.V14SU4a_CSCwr21851_remote_code_v1.cop.sha512
15 15SU4 (Mar 2026) or apply patch file:
ciscocm.V15SU2_CSCwr21851_remote_code_v1.cop.sha512
ciscocm.V15SU3_CSCwr21851_remote_code_v1.cop.sha512
Unity Connection
Cisco Unity Connection Release First Fixed Release
12.5 Migrate to a fixed release
14 14SU5 or apply patch file:
ciscocm.cuc.CSCwr29208_C0266-1.cop.sha512
15 15SU4 (Mar 2026) or apply patch file:
ciscocm.cuc.CSCwr29208_C0266-1.cop.sha512

References:
[1] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-rce-mORhqY4b
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-20045
[3] https://www.cisa.gov/news-events/alerts/2026/01/21/cisa-adds-one-known-exploited-vulnerability-catalog

 

View Most Recent Advisories