A critical vulnerability in Cisco's Unified CM, tracked as CVE-2026-20230, has been patched, but not before public proof-of-concept code emerged, allowing unauthenticated attackers to launch server-side request forgery (SSRF) attacks remotely. The high-severity flaw, caused by improper validation of certain HTTP requests, enables remote attackers to write files that could potentially be used to gain root privileges. Cisco has addressed the issue, but the availability of public exploit code increases the risk of exploitation. The vulnerability affects both Unified CM and Unified CM SME, and its exploitation status is being closely monitored by Cisco. Successful exploitation could have significant consequences, including the potential for attackers to gain elevated privileges1. This vulnerability matters to practitioners because it highlights the importance of prompt patching, especially when public exploit code is available, and the need for ongoing monitoring to determine whether a "patch-now" approach is necessary.