Cisco Unified CM WebDialer SSRF → Root — CVE-2026-20230

CVE-2026-20230 is a server-side request forgery (SSRF) vulnerability in Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (SME). The flaw stems from improper validation of specific HTTP requests to the WebDialer service. An unauthenticated, remote attacker who can reach the WebDialer endpoint sends a crafted HTTP request that the appliance forwards on the attacker's behalf, enabling the attacker to write files to the underlying operating system. Cisco assigned CVSS 8.6 but rated the advisory Security Impact Rating: Critical because the file-write primitive can be chained to elevate to root.

Exploitation chain (as observed in the wild): per Defused Cyber, attackers abuse the WebDialer SSRF to deploy a rogue Apache Axis2 service, use it to write a first-stage JSP file-writer, then drop a second-stage command-execution webshell under /platform-services/axis2-web/, and from there escalate to root. The exploit uses file:// URI payloads and requires the attacker to learn the target's hostname before the file-write step.

Affected: Unified CM / SME Release 14 (prior to 14SU6) and Release 15 (prior to 15SU5), only where the WebDialer service is enabled (it is disabled by default). Fixed in 14SU6 and 15SU5 (an interim COP patch is available for 15.x). Cisco disclosed and patched on 2026-06-03; public PoC code exists; Defused Cyber observed first-ever in-the-wild exploitation over the weekend of 2026-06-20/21 from a single source IP, beginning with a reconnaissance probe that writes /tmp/cve-2026-20230-test.txt.

Defender priority: Patch Unified CM / SME to 14SU6 / 15SU5+ (or apply the 15.x COP) now. If you cannot patch immediately, disable WebDialer if it is not required and restrict network access to the CUCM web/admin interfaces to trusted management subnets. Unified CM is a hardened Cisco appliance with no Falcon sensor — so the highest-value Falcon angle is detecting the exploit being launched from a managed host and post-exploitation pivoting from the CUCM management IP into your endpoint/identity estate; the appliance itself is hunted via its native Tomcat/OS logs (§7).

Decision: The only published atomic indicators are the reconnaissance artifact /tmp/cve-2026-20230-test.txt and the webshell drop path under /platform-services/axis2-web/; the attacking source IP and payload hashes were not published as of 2026-06-26. This pack ships those two real path indicators plus behavioral signatures; atomic IP/hash fields use REPLACE_WITH_… placeholders so nothing is fabricated.

Hunt hypotheses

• H1: A managed host (admin workstation, jump box, or already-compromised internal host) issues anomalous HTTP/S to the CUCM web ports (8080/8443) — the recon/exploit origin.
• H2: A managed host runs an exploit tool whose command line references WebDialer, axis2, or a file:// URI aimed at the CUCM host — the exploit being launched from inside the estate.
• H3: The CUCM management IP initiates inbound connections to managed endpoints on non-telephony ports — post-exploit reverse shell / pivot landing on a Falcon-visible host.
• H4: The CUCM AD/LDAP integration or admin service account is used to log on from an unexpected source host — credential pivot after root on the appliance.
• H5: Any host in the estate contacts the attacker's source IP (network or DNS) — estate-wide IOC sweep once the IP is known.

Attack chain

Two atomic path indicators are published; IP/hash indicators are not (as of 2026-06-26). Replace REPLACE_WITH_… values from your own incident telemetry or a vetted feed before alerting.

Affected: Cisco Unified CM and Unified CM SME Release 14 (prior to 14SU6) and Release 15 (prior to 15SU5), with the WebDialer service enabled (disabled by default). Fixed: 14SU6 / 15SU5 or later; interim COP patch for 15.x. The appliance runs a Cisco-hardened Linux with an embedded Tomcat; web services listen on 8443 (HTTPS) and 8080 (HTTP).

Because Unified CM is a closed appliance with no Falcon sensor, the appliance-side hunt runs in CUCM's own logs (collect via RTMT or forward syslog/Tomcat logs to your SIEM). These complement the Falcon CQL in §8, which covers the managed-estate side.

CUCM Tomcat access log (WebDialer / Axis2 abuse)

# Look for requests to the WebDialer endpoint and any axis2-web access (collect Tomcat
# access logs via RTMT: Cisco Tomcat Access Log, or forward to SIEM).
#   - Requests to /webdialer/ or /cucm-uds/ from unexpected source IPs (no admin session)
#   - ANY request under /platform-services/axis2-web/  (webshell drop path)
#   - POST/PUT carrying file:// in the query/body  (SSRF payload)
SIEM  sourcetype=cisco:cucm:tomcat uri_path IN ("/webdialer/*","/platform-services/axis2-web/*")
      | stats count min(_time) max(_time) values(uri_path) by src_ip, status

CUCM platform / OS audit (recon + webshell artifacts)

• Search forwarded platform/syslog for creation of /tmp/cve-2026-20230-test.txt — the published reconnaissance probe artifact.
• Hunt for any new .jsp or Axis2 service deployment under /platform-services/axis2-web/ outside a Cisco upgrade window.
• Review show webapp session list / admin CLI audit for unexpected privileged activity around the exploitation window (weekend of 2026-06-20).

Configuration check (exposure)

• Confirm whether the WebDialer feature service is Activated in Cisco Unified Serviceability — if not required, deactivate it (removes the attack surface entirely).
• Confirm CUCM 8443/8080 are reachable only from trusted management subnets (firewall/segmentation).

If you forward CUCM Tomcat/platform logs into Falcon Next-Gen SIEM, the §8 CQL field references still apply to your Falcon endpoint/identity data; the appliance log hunts above are parser-dependent and shown as pre.code SIEM pseudo-queries, not Falcon CQL.

Scope note: CUCM has no Falcon sensor, so these queries hunt the managed estate around the appliance — exploit origin, pivot landing, and credential reuse. Set the REPLACE_WITH_CUCM_IP values to your Unified CM cluster management addresses before running.

// HUNT: Managed host -> CUCM web/admin ports (CVE-2026-20230 recon / exploit origin)
// MITRE: T1190 | CONF: medium  FP: medium  COST: low | REQUIRES: NetworkConnectIP4 + CUCM IP list
// FALSE POSITIVES: CUCM admin workstations, provisioning/monitoring tools
// TUNING: replace the RemoteAddressIP4 regex with your CUCM cluster IPs; allowlist known admin aids
#event_simpleName=/NetworkConnectIP4/
| RemoteAddressIP4=/^(REPLACE_WITH_CUCM_IP_1|REPLACE_WITH_CUCM_IP_2)$/
| RemotePort=8443 OR RemotePort=8080
| groupBy([ComputerName, aid, RemoteAddressIP4, RemotePort], function=([count(aid, as=conns), collect([ContextBaseFileName])]))
| sort(conns, order=desc)

// HUNT: Exploit-tool command line for CVE-2026-20230 (WebDialer SSRF / Axis2 / file:// payload)
// MITRE: T1190, T1059 | CONF: high  FP: low  COST: medium | REQUIRES: ProcessRollup2 with CommandLine
// FALSE POSITIVES: sanctioned CUCM admin scripts that legitimately call /webdialer/
// TUNING: pair with Q1 origin hosts; allowlist documented admin tooling by ImageFileName
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/(webdialer|axis2|platform-services|file:\/\/.{0,80}(passwd|etc|tmp))/i
| ImageFileName=/(curl|wget|python[0-9.]*|perl|powershell|pwsh|java)/i
| groupBy([ComputerName, ImageFileName, CommandLine], function=([count(aid, as=hits), collect([UserName])]))
| sort(hits, order=desc)

// HUNT: Inbound connection from CUCM management IP to a managed endpoint (CVE-2026-20230 pivot)
// MITRE: T1021 | CONF: medium  FP: medium  COST: medium | REQUIRES: NetworkConnectIP4 + CUCM IP list
// FALSE POSITIVES: legitimate CUCM mgmt/SNMP/telephony to endpoints
// TUNING: set CUCM IPs; exclude sanctioned RemotePort values (e.g. 161, 5060, 2000)
#event_simpleName=/NetworkConnectIP4/
| RemoteAddressIP4=/^(REPLACE_WITH_CUCM_IP_1|REPLACE_WITH_CUCM_IP_2)$/
| RemotePort!=5060 AND RemotePort!=2000 AND RemotePort!=161 AND RemotePort!=443
| groupBy([ComputerName, RemoteAddressIP4, RemotePort, ContextBaseFileName], function=count(aid, as=conns))
| sort(conns, order=desc)

// HUNT: CUCM service/LDAP account logon away from the CUCM cluster (CVE-2026-20230 credential pivot)
// MITRE: T1078 | CONF: medium  FP: medium  COST: low | REQUIRES: UserLogon telemetry + known CUCM account
// FALSE POSITIVES: broadly-scoped service accounts; tighten UserName to the real CUCM account(s)
// TUNING: replace REPLACE_WITH_CUCM_SVC_ACCT; allowlist legitimate logon hosts
#event_simpleName=/UserLogon/
| UserName=/^(REPLACE_WITH_CUCM_SVC_ACCT)$/i
| groupBy([UserName, ComputerName, LogonType, RemoteAddressIP4], function=([count(aid, as=logons), max(LogonType, as=lt)]))
| sort(logons, order=desc)

// HUNT: Estate-wide contact with the CVE-2026-20230 attacker IP / C2 (fill from incident or feed)
// MITRE: T1071 | CONF: medium  FP: low  COST: low | REQUIRES: NetworkConnectIP4 / DnsRequest
// FALSE POSITIVES: low once the indicator is vetted; widen RemoteAddressIP4 to a list as needed
// TUNING: replace REPLACE_WITH_SRC_IP / REPLACE_WITH_C2_DOMAIN with real values
#event_simpleName=/NetworkConnectIP4|DnsRequest/
| RemoteAddressIP4=/^(REPLACE_WITH_SRC_IP)$/ OR DomainName=/REPLACE_WITH_C2_DOMAIN/i
| groupBy([ComputerName, RemoteAddressIP4, DomainName, RemotePort], function=count(aid, as=hits))
| sort(hits, order=desc)

Field-name note: queries use standard Falcon fields (#event_simpleName, RemoteAddressIP4, RemotePort, ComputerName, aid, ContextBaseFileName, ImageFileName, CommandLine, UserName, LogonType, DomainName). All REPLACE_WITH_… tokens (CUCM IPs, service account, attacker IP/domain) must be filled in for your tenant before the queries return meaningful results.

Network/identity IOAs depend on your Falcon module set (NGSIEM / Identity Protection). Where a network IOA is not available, run Q3 as a scheduled search instead. Start every IOA in Detect, then promote the high-fidelity command-line IOA to Prevent.

Two real path indicators are shipped below; IP/hash rows use REPLACE_WITH_… placeholders — do not import the atomic rows until populated from your own incident data or a vetted feed.

type,value,action,severity,expiration,description,tags
ipv4,REPLACE_WITH_SRC_IP,detect,high,2026-12-26,CVE-2026-20230 attacker IP (fill from incident),campaign:CVE-2026-20230
sha256,REPLACE_WITH_SHA256,prevent,critical,2026-12-26,CVE-2026-20230 webshell/payload,campaign:CVE-2026-20230
domain,REPLACE_WITH_C2_DOMAIN,detect,high,2026-09-26,CVE-2026-20230 C2 domain,campaign:CVE-2026-20230

RECON  /tmp/cve-2026-20230-test.txt                 -> probe artifact written by SSRF
SHELL  /platform-services/axis2-web/*.jsp           -> second-stage webshell drop path
HTTP   /webdialer/*                                 -> vulnerable WebDialer endpoint (Tomcat access log)
HTTP   POST/PUT body or query containing file://    -> SSRF payload indicator

BEHAVIOR: Managed host -> CUCM 8443/8080 from non-admin source            -> hunt    (Q1)
BEHAVIOR: Cmd line webdialer|axis2|file:// targeting CUCM host            -> detect  (Q2)
BEHAVIOR: Inbound conn FROM CUCM mgmt IP to endpoint, odd port           -> detect  (Q3)
BEHAVIOR: CUCM LDAP/service account logon away from the cluster          -> hunt    (Q4)
BEHAVIOR: Any host contacts attacker source IP / C2 domain               -> detect  (Q5)

FIXED: Unified CM/SME 14SU6+ (Release 14) | 15SU5+ (Release 15) | interim COP for 15.x
PREREQ: only exploitable when the WebDialer feature service is ACTIVATED (default: deactivated)
AUDIT: Cisco Unified Serviceability -> Tools -> Service Activation -> check WebDialer state
EXPOSE: restrict CUCM 8443/8080 to trusted management subnets (firewall/segmentation)
ADVISORY: cisco-sa-cucm-ssrf-cXPnHcW | disclosed 2026-06-03 | ITW from weekend of 2026-06-20

1 · Confirm version + WebDialer state on every CUCM node

# CUCM admin CLI (SSH to each node):
show version active
# In Cisco Unified Serviceability -> Tools -> Service Activation:
#   confirm whether "Cisco WebDialer Web Service" is Activated.
# Flag any node on Release 14 < 14SU6 or Release 15 < 15SU5 as VULNERABLE,
# and any node with WebDialer Activated as EXPLOITABLE.

2 · Restrict CUCM web exposure (interim, until patched)

# Upstream firewall: permit only the management subnet to CUCM web ports.
# Example (adjust to your platform), allow admin subnet to 8443/8080, deny the rest:
permit tcp 10.0.0.0/24 host CUCM_IP eq 8443
permit tcp 10.0.0.0/24 host CUCM_IP eq 8080
deny   tcp any host CUCM_IP eq 8443
deny   tcp any host CUCM_IP eq 8080
# Verify no internet path reaches CUCM 8443/8080 from an external scanner.

3 · Appliance-side sweep for exploitation artifacts

# Via RTMT or forwarded logs (CUCM is closed — use supported tooling, not shell):
#  - Search platform/syslog for creation of: /tmp/cve-2026-20230-test.txt
#  - Search Tomcat access log for requests under: /platform-services/axis2-web/
#  - Search Tomcat access log for /webdialer/ requests carrying file:// payloads
# Any hit -> treat the node as compromised and run the section 14 containment runbook.

CUCM is a closed Cisco appliance — do not attempt unsupported shell access. Use the admin CLI, Cisco Unified Serviceability, and RTMT / forwarded logs for all checks above.

Coverage gap (by design): Unified CM is a closed appliance with no Falcon sensor, so on-appliance execution and privilege escalation are not directly visible in Falcon. This pack deliberately covers the estate around the appliance (exploit origin, pivot, credential reuse, IOC sweep) and routes the on-box detection to CUCM's native Tomcat/platform logs (§7). Close the gap by forwarding CUCM logs to your SIEM and enforcing firewall/NDR visibility on 8443/8080.