CVE-2026-20362
Cisco Finesse Server-Side Request Forgery Vulnerability
CVE-2026-20362 is a high-severity server-side request forgery (SSRF) vulnerability in Cisco Finesse’s web-based management interface. An unauthenticated remote attacker can send crafted HTTP requests through an affected server to obtain limited sensitive information from associated services. The vulnerability has a CVSS v3.1 score of 7.2 (High).
Discovered by Horizon3 researchers Noah King and Brandon Peterson, the vulnerability affects Finesse regardless of configuration. Cisco PSIRT reports no known malicious use. As of October 27, 2026, fixes remain scheduled for January and February 2027.
Technical Details
The flaw stems from improper input validation in the Finesse web interface. An attacker needs network access to the affected interface, but exploitation requires neither authentication nor user interaction.
Horizon3’s technical findings identify the embedded Apache Shindig content proxy as the affected component. The proxy retrieves an attacker-supplied URL from the server and returns the response to the unauthenticated caller.
An attacker can direct these requests to loopback-only or internal network services. For example, the Finesse REST API at 127.0.0.1:8082 exposes a SystemInfo response containing the deployment type, primary and secondary node hostnames, and XMPP domain. This enables infrastructure enumeration and access to responses from services that are not directly reachable externally.
Stop Guessing, Start Proving
NodeZero® Proactive Security Platform Rapid Response
A NodeZero Rapid Response test has been developed to safely validate whether this vulnerability can be exploited in your environment. The test executes real attack techniques without causing damage, giving teams immediate clarity on exposure.
- Run the Rapid Response test: Launch from NodeZero to determine whether exploitation is possible.
- Reduce exposure now and patch when available: Restrict access to trusted networks or authenticated VPN connections while awaiting Cisco’s fixed releases. Apply the appropriate update when released.
- Re-run the test: Assess the effectiveness of access restrictions from the relevant network locations, then verify that the vulnerability is no longer exploitable after patching.
Affected Versions & Patch
Affected
| Product | Affected release families |
| Cisco Finesse | 12.6 and earlier; 15.0 |
| Cisco Packaged Contact Center Enterprise and Unified Contact Center Enterprise | Earlier than 15.0; 15.0 |
| Cisco Unified Contact Center Express | 12.5 and earlier; 15.0 |
Cisco Unified Intelligence Center is not affected.
Fixed
No fixed release is available as of October 27, 2026. Cisco lists the following planned releases:
| Product | Planned first fixed release | Target availability |
| Cisco Finesse | 15.0(1) SU3 | February 2027 |
| Cisco Packaged CCE and Unified CCE | 15.0(1)ES202701 | January 2027 |
| Cisco Unified CCX | 15.0(1) SU2 | February 2027 |
Older branches require migration to a fixed release. Upgrading to an affected 15.0 release does not resolve the vulnerability. Review Cisco’s advisory for updated availability.
Mitigations
Cisco lists no workaround that addresses the vulnerability.
While awaiting patches, reduce exposure by restricting the Finesse web interface to trusted networks or authenticated VPN connections. Monitor for unexpected requests from Finesse servers to internal services. These measures reduce opportunities for exploitation; they do not correct the underlying flaw.
Timeline
- October 7, 2026: Cisco published its advisory, credited Horizon3’s researchers, and announced planned fixed releases.
- October 7, 2026: NVD published the vulnerability record.
- October 27, 2026: Horizon3 released the NodeZero Rapid Response test for CVE-2026-20362.
