PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-20045 Cisco CVE debrief

CVE-2026-20045 is a Cisco Unified Communications Products code injection vulnerability affecting Cisco Unified Communications Manager and listed by CISA in the Known Exploited Vulnerabilities (KEV) catalog. Because it is already in KEV, this should be treated as a high-priority remediation item. The supplied corpus does not include CVSS data or deeper technical detail, so the safest response is to inventory affected Cisco deployments, follow Cisco’s advisory and mitigations, and meet the CISA due date of 2026-02-11.

Vendor
Cisco
Product
Unified Communications Manager
CVSS
HIGH 8.2
CISA KEV
Listed
Original CVE published
2026-01-21
Original CVE updated
2026-01-21
Advisory published
2026-01-21
Advisory updated
2026-01-21

Who should care

Cisco Unified Communications Manager administrators, VoIP and collaboration platform owners, telecom/UC operations teams, vulnerability management, and incident response teams—especially if the system is internet-facing, mission-critical, or difficult to service.

Technical summary

The supplied sources identify this issue as a code injection vulnerability in Cisco Unified Communications Products, specifically Cisco Unified Communications Manager. CISA has placed it in the KEV catalog, which indicates known exploitation is a concern and that remediation should be expedited. No additional exploit mechanics, affected versions, or CVSS rating are included in the provided corpus.

Defensive priority

Urgent. KEV inclusion makes this a top-tier remediation item, with CISA’s due date set to 2026-02-11.

Recommended defensive actions

  • Identify all Cisco Unified Communications Manager and related Cisco Unified Communications deployments in your environment.
  • Review Cisco’s official security advisory for version-specific remediation and mitigation guidance.
  • Apply vendor-recommended mitigations and updates as soon as they are available.
  • If mitigations are unavailable, consider discontinuing use of the product per CISA guidance.
  • For cloud services, follow applicable BOD 22-01 guidance.
  • Prioritize validation, change control, and post-remediation verification before the 2026-02-11 due date.

Evidence notes

This debrief is based only on the supplied CISA KEV metadata and the referenced official links. The corpus confirms: CVE-2026-20045; vendor Cisco; product Cisco Unified Communications Manager; vulnerability name 'Cisco Unified Communications Products Code Injection Vulnerability'; KEV dateAdded 2026-01-21; dueDate 2026-02-11; and CISA’s recommended action to apply vendor mitigations, follow BOD 22-01 for cloud services, or discontinue use if mitigations are unavailable. No CVSS score/severity or deeper technical specifics were provided.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-20045 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-20045

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-20045 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-20045

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.