Cisco has now confirmed what defenders had suspected: attackers are actively exploiting a vulnerability in Unified Communications Manager, the platform that runs enterprise phone and collaboration systems, as reported by SecurityWeek and BleepingComputer.

The timeline is the familiar one. A proof-of-concept exploit went public when the flaw was disclosed, and the first real attacks followed within about a week. That gap, between the moment the world learns about a bug and the moment a company confirms whether it is exposed, is where breaches live. For infrastructure like Unified CM, patched on slow enterprise change cycles and often wired deep into directory services, the gap tends to be dangerously wide.

Cisco has released a fixed version, and if you cannot deploy it immediately, the interim move is to lock down management-interface exposure and watch for unusual administrative activity. Because the exploit has been public for a while, it is also worth assuming some exposure already happened and reviewing your logs backward rather than only forward.

The wider point is about clocks. When exploitation reliably follows disclosure within days, an assessment cadence measured in months is simply the wrong instrument. Knowing, on the day a flaw goes public, whether your specific deployment is exposed is the whole difference between patching and cleaning up.

Sources: SecurityWeek and BleepingComputer.