CVE-2026-20045Vulnerability
Cisco Unified Communications Products Code Injection Vulnerability
Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .
Reported by 2 independent sources · first reported by Trend Micro Research · last reported
Last reported 27 days ago
CISA KEVAdded 21 Jan 2026
Fix due 11 Feb 2026
Used by ransomware: not knownCISA KEV catalogue
Fix due 11 Feb 2026
Used by ransomware: not knownCISA KEV catalogue
EPSS4.5%
higher than 91% of CVEsFIRST EPSS, as of 23 Oct 2026
higher than 91% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
2 reports, newest first · the exact sentence from each-
Cyber Brief 26-02 - January 2026“On January 21, Cisco disclosed and patched a critical Unified Communications and Webex Calling remote code execution zero-day, CVE-2026-20045, actively exploited to gain root access via crafted HTTP requests against management interfaces.”
-
U.S. Public Sector Under Siege: Threat Intelligence for Q1 2026“CVE-2026-20045”
Indicators reported together
named in the same reportsAlso named with it: CVE-2026-21509, CVE-2026-1281, CVE-2025-8088, CVE-2025-53690, CVE-2025-64155, CVE-2020-12812, CVE-2025-12825, CVE-2026-20860, CVE-2025-38067, CVE-2026-20274
Thanks — we review every report.