Cisco Unified Communications Manager, Unified Communications Manager IM & Presence Service und Unity Connection: Schwachstelle ermöglicht Codeausführung
WID-SEC-2026-0192 · first 22.01.2026 · updated 22.01.2026 · CVSS 8,2
What it is about
Der Cisco Unified Communications Manager (CUCM, ehemals CallManager) dient zur Gesprächsvermittlung in IP-Telefonie-Netzen. Der Cisco Unified Communications Manager (CUCM) (ehemals CallManager) dient zur Gesprächsvermittlung in IP-Telefonie-Netzen. Cisco Unity Connection ist ein umfangreiches Voicemail und Integrated-Messaging- Produkt. Mit Cisco Unity Connection können Benutzer mit dem Cisco Unified Personal Communicator auf ihre Sprachnachrichten zugreifen, das Display ihres Cisco Unified IP-Telefons nutzen, um Sprachnachrichten anzuzeigen, zu sortieren und wiederzugeben, und sogar die Sprachsteuerung von Cisco Unity Connection verwenden, um auf Cisco Unified MeetingPlace Express Meetings zuzugreifen. Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Cisco Unified Communications Manager (CUCM), Cisco Unified Communications Manager IM & Presence Service und Cisco Unity Connection ausnutzen, um beliebigen Programmcode auszuführen.
Under what conditions?
Over the network and without logging in. This is the most dangerous combination: attackers can scan reachable devices automatically.
What can happen in the worst case
An attacker could use the vulnerability to
- beliebigen Programmcode auszuführen
Am I affected?
Affected according to the BSI:
- Cisco Unified Communications Manager (CUCM) <14SU5
- Cisco Unified Communications Manager (CUCM) <15SU4
- Cisco Unified Communications Manager IM & Presence Service <14SU5
- Cisco Unified Communications Manager IM & Presence Service <15SU4
- Cisco Unity Connection <14SU5
- Cisco Unity Connection <15SU4
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Cisco Unified Communications Manager (CUCM) 14SU5
- Cisco Unified Communications Manager (CUCM) 15SU4
- Cisco Unified Communications Manager IM & Presence Service 14SU5
- Cisco Unified Communications Manager IM & Presence Service 15SU4
- Cisco Unity Connection 14SU5
- Cisco Unity Connection 15SU4
Is the vulnerability already being exploited?
- CVE-2026-20045: exploited in the wild according to CISA, in the catalogue since 21.01.2026.
Information and sources
- Original BSI advisory (WID)
- Cisco Security Advisory vom 2026-01-21 sec.cloudapps.cisco.com
CVE: CVE-2026-20045
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.