CISA Known Exploited Vulnerability

This vulnerability is actively exploited in the wild and listed in the CISA Known Exploited Vulnerabilities catalog.

Remediation Deadline: Feb 11, 2026

CVE-2026-20045

High

EPSS 0.9%CISA KEV

Cisco/Unified Communications Manager

Description

Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance contain a code injection vulnerability that could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root.

EPSS — Exploit Probability

0.9%

Higher than 75.6% of all CVEs

Required Action

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-rce-mORhqY4b ; https://nvd.nist.gov/vuln/detail/CVE-2026-20045

Risk Assessment

ELEVATED

In CISA KEV

Details

Severity: High
EPSS: 0.9%
CISA KEV: Yes
Ransomware: Unknown
Articles: 0

Timeline

Published

Jan 21, 2026

Added to KEV

Jan 21, 2026

Remediation Due

Feb 11, 2026

Affected Product

Cisco

Unified Communications Manager

View all Cisco CVEs

External Links

NVD (NIST)CVE Details MITRE CVE