Critical SSRF Vulnerability in Cisco Unified CM Exploited via Public PoC A proof-of-concept (PoC) exploit has been released for a critical server-side request forgery (SSRF) vulnerability in Cisco Unified Communications Manager (Unified CM) and Unified CM Session Management Edition (Unified CM SME), tracked as CVE-2026-20230. The flaw, rated 8.6 (High) on the CVSS v3.1 scale but classified as Critical by Cisco due to its potential for root-level privilege escalation, exposes vulnerable systems to remote exploitation. The vulnerability arises from improper input validation in HTTP requests (CWE-918), allowing unauthenticated attackers to interact with internal services. By sending crafted HTTP requests, threat actors can perform SSRF attacks and write arbitrary files to the underlying OS, enabling privilege escalation and potential full system compromise. Exploitation is only possible if the Cisco WebDialer service disabled by default but active in some deployments is enabled. The public release of the PoC exploit heightens the risk, as it provides attackers with a functional attack method. Security researchers confirm the exploit demonstrates SSRF-based file-writing capabilities, which could be used for persistence or further lateral movement, particularly in internet-facing or compromised internal networks. Affected systems include Cisco Unified CM and Unified CM SME with the WebDialer service running. Administrators can check vulnerability status via the Cisco Unified CM Administration interface under Cisco Unified Serviceability > Control Center – Feature Services. If the Cisco WebDialer Web Service is marked as "Started," the system is exposed. Cisco has released software updates to patch the flaw, with no official workarounds available. As a temporary mitigation, disabling the WebDialer service is recommended. Additional defensive measures include restricting access to management interfaces and monitoring for suspicious outbound HTTP requests or unauthorized file creation. While no active compromises have been reported, organizations are urged to prioritize patching due to the high risk of exploitation and the potential for root-level access. The vulnerability underscores the urgency of securing enterprise communication systems against SSRF-based attacks.

ShinyHunters Claims Responsibility for Alleged DentaQuest Data Breach The cybercriminal group ShinyHunters has claimed responsibility for a suspected data breach targeting DentaQuest, a major U.S. dental and vision insurance provider. While neither DentaQuest nor its parent company, Sun Life U.S. Dental, has officially confirmed the incident, ShinyHunters has threatened to release stolen data on May 27, 2026, though specifics about the compromised information remain undisclosed. Legal teams are investigating the breach to determine whether a class action lawsuit can be filed on behalf of affected individuals, including current and former DentaQuest subscribers. Potential claims could cover damages such as loss of privacy, time spent mitigating the breach, and out-of-pocket costs. Attorneys are seeking input from those who may have been impacted to assess the viability of legal action. ShinyHunters, known for targeting high-profile organizations, has been linked to other breaches in 2026, though details of those incidents remain limited. The group’s involvement in the DentaQuest case underscores ongoing risks in the healthcare sector, where sensitive personal and insurance data remains a prime target for cybercriminals. Further updates are expected as the investigation progresses.

DentaQuest Data Breach Exposes Personal and Health Data of 2.6 Million Individuals DentaQuest, a U.S.-based dental benefits administrator under Sun Life U.S., disclosed a data breach affecting approximately 2.6 million people. The incident was reported to the U.S. Department of Health and Human Services on January 6, 2025, with the company publishing a security update shortly after. The breach involved unauthorized access to a portion of DentaQuest’s network, attributed to the ransomware group ShinyHunters. Exposed data included names, dates of birth, email addresses, genders, government-issued IDs, phone numbers, addresses, and health insurance information. DentaQuest launched an investigation to assess the full scope of the compromise, which remains ongoing as of June 1, 2026. Despite the breach, the company stated its systems remained operational, with minimal disruption to client services. DentaQuest has pledged to provide updates and transparency to affected individuals. No further details on remediation or preventive measures have been released.