A critical security flaw (CVE-2026-20230, CVSS 8.6) in Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (Unified CM SME) is being actively exploited. The vulnerability involves improper input validation for specific HTTP requests, allowing unauthenticated, remote attackers to achieve root-level access. CISA has issued an urgent directive for federal agencies to patch this vulnerability.