Free practical cybersecurity guidance for organisations without a security team.
hello@actionsoncyber.com
Actions On Cyber logo
Contact
← Back to Vulnerability Briefs

Important Cisco Phone System Vulnerability Could Let Attackers Gain Full Control

A serious security flaw has been found in Cisco's Unified Communications Manager, a system used to manage business phone calls. This flaw could let attackers remotely take control of the system if a specific feature is enabled. It is important to check if your organisation uses this system and take steps to protect it.

04 June 2026

Reference: CVE-2026-20230

1. What is being reported?

Researchers have discovered a weakness in Cisco's Unified Communications Manager software that could allow someone outside your organisation to send special requests to the system and potentially take control of it. This happens because the system does not properly check certain messages it receives, which could let an attacker write harmful files and gain the highest level of access.

2. What this means in plain English

If exploited, an attacker could fully control your phone system, potentially disrupting communications or using it to attack other parts of your network. This could lead to loss of service, data breaches, or other serious problems.

3. Could this affect a small business?

Small organisations using Cisco Unified Communications Manager with the WebDialer feature enabled could be at risk. Many small businesses may not use this system or may have the WebDialer feature turned off by default, which reduces the risk. If you are unsure, check with your IT provider.

4. What to do now

  • Ask your IT provider if your organisation uses Cisco Unified Communications Manager and whether the WebDialer service is enabled.
  • If you use this system, ensure it is updated with the latest security patches from Cisco.
  • If WebDialer is not needed, consider disabling it to reduce risk.
  • Monitor your phone system for any unusual activity and report concerns to your IT provider immediately.

5. Ask your IT provider

Can you confirm if our Cisco Unified Communications Manager system has the WebDialer service enabled, and has it been patched against CVE-2026-20230?

6. Bottom line

Check your Cisco phone system settings and update promptly to prevent attackers from gaining full control.

Information based on NVD, CISA KEV, and reputable security news reports.

Back to Vulnerability Briefs