嗯，用户让我用中文总结这篇文章，控制在100字以内，而且不需要特定的开头。首先，我得仔细阅读文章内容，抓住关键点。 文章主要讲的是Cisco修复了一个被积极利用的零日漏洞，编号是CVE-2026-20045。这个漏洞属于远程代码执行类型，CVSS评分为8.2，说明风险很高。攻击者可以利用这个漏洞在受影响设备的操作系统上执行任意命令，进而提升权限到root级别。 受影响的产品包括Cisco Unified CM、Unified CM SME、IM & Presence、Unity Connection和Webex Calling Dedicated Instance。 Cisco已经发布了补丁，并建议用户升级到修复版本。此外，文章还提到没有可用的解决方法，只能通过升级来缓解风险。 总结的时候，我需要涵盖漏洞的严重性、影响范围、攻击方式以及修复建议。同时要控制在100字以内，所以得简洁明了。 可能的结构是：Cisco修复了零日漏洞CVE-2026-20045，影响多个统一通信产品；该漏洞允许远程攻击者执行任意代码并提升权限；建议用户升级到最新版本以缓解风险。 检查一下是否符合要求：没有使用“文章内容总结”之类的开头，直接描述内容；控制在100字以内。看起来没问题。 </think> Cisco修复了被积极利用的零日漏洞CVE-2026-20045（CVSS评分8.2），该漏洞存在于统一通信和Webex Calling中。未认证远程攻击者可利用此漏洞在受影响设备的操作系统上执行任意命令，并提升权限至root级别。建议用户升级至修复版本以缓解风险。 2026-1-21 23:47:15 Author: securityaffairs.com(查看原文) 阅读量:1 收藏
Cisco fixed actively exploited Unified Communications zero day
Cisco patched a critical zero-day RCE flaw (CVE-2026-20045) in Unified Communications and Webex Calling that is actively exploited in the wild.
Cisco patched a critical zero-day remote code execution flaw, tracked as CVE-2026-20045 (CVSS score of 8.2), actively exploited in attacks.
An unauthenticated, remote attacker can exploit the flaw to execute arbitrary commands on the underlying operating system of an affected device.
The bug affected Cisco Unified CM, Unified CM SME, IM & Presence, Unity Connection, and Webex Calling Dedicated Instance.
“This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device.” reads the advisory. “A successful exploit could allow the attacker to obtain user-level access to the underlying operating system and then elevate privileges to root.”
Below are impacted versions:
Unified CM, Unified CM IM&P, Unified CM SME, and Webex Calling Dedicated Instance
| Cisco Unified CM, Unified CM IM&P, Unified CM SME, and Webex Calling Dedicated Instance Release | First Fixed Release |
|---|---|
| 12.5 | Migrate to a fixed release. |
| 14 | 14SU5 or apply patch file:1 ciscocm.V14SU4a_CSCwr21851_remote_code_v1.cop.sha512 |
| 15 | 15SU4 (Mar 2026) or apply patch file:1 ciscocm.V15SU2_CSCwr21851_remote_code_v1.cop.sha512 ciscocm.V15SU3_CSCwr21851_remote_code_v1.cop.sha512 |
1. Patches are version-specific. Consult the README attached to the patch for details.
Unity Connection
| Cisco Unity Connection Release | First Fixed Release |
|---|---|
| 12.5 | Migrate to a fixed release. |
| 14 | 14SU5 or apply patch file:1 ciscocm.cuc.CSCwr29208_C0266-1.cop.sha512 |
| 15 | 15SU4 (Mar 2026) or apply patch file:1 ciscocm.cuc.CSCwr29208_C0266-1.cop.sha512 |
1. Patches are version-specific. Consult the README attached to the patch for details.
The networking giant confirmed that there are no workarounds that address this vulnerability.
“The Cisco PSIRT is aware of attempted exploitation of this vulnerability in the wild. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.” concludes the advisory.
Early January, Cisco addressed a medium-severity vulnerability, tracked as CVE-2026-20029 (CVSS score: 4.9), in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) after a public PoC exploit was disclosed.
The vulnerability resides in the licensing feature of Cisco ISE and ISE-PIC due to improper XML parsing in the web management interface. An authenticated remote attacker with administrative privileges could exploit it by uploading a malicious file, enabling the reading of arbitrary files on the underlying operating system that should not be accessible, even to administrators.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CVE-2026-20045)
如有侵权请联系:admin#unsafe.sh