Cisco patches critical zero-day, urges immediate action

CISA has added privilege escalation bug to its KEV catalogue

Cisco has patched a critical zero-day vulnerability in its Unified Communications Manager, Session Management Edition, IM & Presence Service, Unity Connection, and Webex Calling Dedicated Instance platforms.

In an advisory, Cisco explains that the vulnerability allows unauthenticated remote attackers to execute arbitrary code and escalate privileges to root.

The vulnerability, tracked as CVE-2026-20045 with a CVSS severity score of 8.2, is already being exploited by attackers, prompting Cisco to urge customers to immediately upgrade their systems or apply version-specific patches to fix the issue.

The US Cybersecurity and Information Security Agency (CISA) has added it to its Known Exploited Vulnerabilities (KEV) catalogue, requiring federal agencies to patch or upgrade their systems by 11^th February.

According to Cisco the issue arises from “improper validation of user-supplied input in HTTP requests” to the web-based management interface of an affected device. Attackers sending specially crafted HTTP requests can use the bug to bypass authentication requirements.

Cisco has not provided any temporary workarounds, instead urging affected customers to patch their systems or upgrade to new versions in which the vulnerability has been fixed.

This fix comes shortly after Cisco addressed another critical remote code execution bug (CVE-2025-20393) in its Secure Email Gateway and Web Manager. That vulnerability, which also came under active attacks allowed threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance.