CISA Sets Urgent Deadline to Fix Cisco Flaw Actively Exploited in Attacks

CISA Issues Emergency Patch Order for Cisco UCM Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a Cisco Unified Communications Manager (UCM) Server vulnerability to its Known Exploited Vulnerabilities (KEV) catalog and is giving federal agencies an urgent Sunday deadline to patch the flaw, citing active exploitation by threat actors in the wild.

The move signals that CISA has confirmed real-world attacks leveraging this vulnerability against U.S. government and critical infrastructure targets, triggering the mandatory remediation requirements under Binding Operational Directive 22-01 (BOD 22-01).

What Is the Cisco UCM Vulnerability?

Cisco Unified Communications Manager is the core call processing platform for enterprise IP telephony, widely deployed across federal agencies, healthcare, finance, and large enterprises. A vulnerability in Cisco UCM Server allows attackers to exploit the system in ways that could enable unauthorized access, privilege escalation, or lateral movement within the affected environment.

CISA's classification as a KEV means the agency has evidence of active exploitation — not merely theoretical risk. Active exploitation of UCM vulnerabilities is particularly dangerous because UCM systems:

• Handle voice and video communications across entire organizations
• Are deeply integrated with Active Directory and LDAP authentication
• Often have high-privileged network access to facilitate call routing
• May be reachable from external networks for remote worker support

CISA KEV Catalog — What It Means

When CISA adds a vulnerability to the KEV catalog:

1. Federal civilian agencies (FCEB) under BOD 22-01 are legally required to patch within the prescribed deadline
2. Critical infrastructure operators are strongly encouraged to prioritize remediation
3. Private sector organizations should treat KEV additions as high-priority patch events

The tight Sunday deadline imposed here — rather than the standard 2-3 week window — underscores CISA's assessment that exploitation is imminent or already widespread in federal environments.

Why UCM Is a High-Value Target

Cisco UCM servers represent a particularly attractive target for threat actors because:

• Authentication gateway: UCM integrates with enterprise identity systems, making it a potential pivot point for credential theft
• Network position: UCM servers typically sit in privileged network segments with broad internal access
• Business disruption potential: Compromising UCM can take down voice communications across an entire organization
• Intelligence value: For nation-state actors, intercepting or monitoring UCM traffic provides significant intelligence collection opportunities

Recommended Actions

For Federal Agencies

Per BOD 22-01, all FCEB agencies must apply the Cisco-provided patch before the CISA-mandated Sunday deadline. Failure to comply must be reported to CISA.

For All Organizations

1. Apply the Cisco patch immediately — Check Cisco's Security Advisory portal for the specific patch addressing this vulnerability
2. Verify UCM is not internet-exposed — UCM should never be directly reachable from the public internet. Verify firewall rules
3. Review UCM access logs — Look for unusual authentication attempts, unexpected IP addresses, or off-hours activity
4. Audit UCM integrations — Check which systems UCM connects to (Active Directory, LDAP, databases) and ensure those are also monitored
5. Check for indicators of compromise — If UCM may have been exposed, conduct a forensic review before assuming no compromise occurred

Detection Queries

Splunk — Cisco UCM Unusual Auth Activity

index=cisco_ucm sourcetype=cisco:ucm:auth
| stats count by src_ip, user, action
| where action="FAILED" AND count > 10
| sort -count

Network — Look for UCM Scanning Activity

dst_port IN [2000, 2443, 8443, 443] AND dst_host = <ucm_server>
AND src_ip NOT IN <known_internal_ranges>

CISA KEV Enforcement Timeline

Broader Context: CISA's UCM Enforcement Push

This is not the first time CISA has targeted Cisco UCM vulnerabilities. Cisco's communications infrastructure has been a recurring focus of KEV additions, reflecting both the platform's ubiquity in federal environments and threat actors' interest in compromising communications infrastructure for intelligence collection and operational disruption.

Organizations that have not already inventoried their Cisco UCM deployments and established a rapid-patching process for KEV additions should use this event as a forcing function to build that capability.

Sources

• BleepingComputer — CISA Sets Urgent Deadline to Fix Cisco Flaw
• CISA Known Exploited Vulnerabilities Catalog
• Cisco Security Advisories

Related Reading

• CVE-2025-55017: Apache IoTDB Critical Path Traversal
• CVE-2025-64152: Apache IoTDB Second Path Traversal Flaw