CVE-2026-20230, a CVSS 9.5 unauthenticated SSRF in Cisco Unified Communications Manager and Unified CM SME, is under active exploitation with a public proof-of-concept published less than three weeks after Cisco released patches on June 3, 2026. Attackers can use file:// URI payloads against the WebDialer service to achieve arbitrary file write and root privilege escalation without any credentials. The EPSS score of 0.259 at the 97.7th percentile signals high exploitation probability relative to the broader CVE population.