Cisco fixes Unified Communications RCE zero day exploited in attacks

Cisco patched CVE-2026-20045, a critical remote code execution vulnerability in Cisco Unified Communications Manager, Unified CM SME, Unified CM IM & Presence, Cisco Unity Connection, and Webex Calling Dedicated Instance that has been observed exploited in the wild; successful exploitation can yield user-level access and escalation to root. Cisco released version-specific patches (README advised), stated there are no viable workarounds, and CISA added the CVE to its KEV catalog with a federal remediation deadline of February 11, 2026.