# CVE-2026-20045: A Cisco Unified Communications Manager bug is being used in attacks

Status: Being used now (CISA KEV, added 2026-01-21)
Who: 
Do this: 

## Agent prompt (read-only)
Read-only check, change nothing, send nothing anywhere.
Is Cisco Unified Communications Manager (CVE-2026-20045) installed or running on this machine or in this project?
1. Find every copy and its version (apps, packages, containers, lockfiles).
2. Compare each version against the vendor's fixed version for CVE-2026-20045. Quote the vendor page you used.
3. Report a table: where, version, fixed version, status (exposed / fixed / not installed / unsure).
4. List the exact update steps, but do not run them.

## Official description
Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unity Connection, and Cisco Webex Calling Dedicated Instance contain a code injection vulnerability that could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root.

## Sources
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-rce-mORhqY4b
- https://nvd.nist.gov/vuln/detail/CVE-2026-20045
- https://nvd.nist.gov/vuln/detail/CVE-2026-20045

Generated by isitexploited.org from public sources. Verify version numbers against the vendor before acting.