Unauthenticated SSRF in Cisco Finesse exposes limited internal data
Original title: CVE-2026-20362 | Cisco Finesse Server-Side Request Forgery Vulnerability
Cisco rates CVE-2026-20362 at 7.2 and says no fixes exist yet, with first patches planned for 2027.
Horizon3 disclosed CVE-2026-20362, a high-severity server-side request forgery flaw in Cisco Finesse’s web management interface. An unauthenticated remote attacker can make the embedded Apache Shindig proxy retrieve an attacker-supplied URL and return limited information from internal services. Cisco PSIRT reports no known malicious use. No fix was available as of October 27, 2026, with first fixed releases planned for January and February 2027.
Unconfirmed: Cisco’s fixed-release dates are planned targets, and no patch was available as of October 27, 2026.
- CVSS v3.1 is 7.2, with no authentication or user interaction required.
- Finesse 12.6 and earlier and 15.0 are affected regardless of configuration.
- Planned fixes include Finesse 15.0(1) SU3 in February 2027.
- Cisco Unified Intelligence Center is not affected, and Cisco lists no workaround.
Impact: Unauthenticated SSRF exposing limited internal service data
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Finesse | 12.6 and earlier; 15.0 | 15.0(1) SU3 planned for February 2027 |
| Cisco Packaged Contact Center Enterprise and Unified Contact Center Enterprise | Earlier than 15.0; 15.0 | 15.0(1)ES202701 planned for January 2027 |
| Cisco Unified Contact Center Express | 12.5 and earlier; 15.0 | 15.0(1) SU2 planned for February 2027 |
- 1.Restrict the Finesse web interface to trusted networks or authenticated VPN connections.
- 2.Monitor for unexpected requests from Finesse servers to internal services.
- 3.Apply Cisco’s planned fixed releases when they become available.
- CVEs
- CVE-2026-20362
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-20362 | Unauthenticated SSRF in Cisco Finesse management interface | 7.2 | — |
From the original article
2 min read at horizon3.ai
CVE-2026-20362 is a high-severity SSRF vulnerability in Cisco Finesse discovered by Horizon3 researchers, with affected versions, mitigations, and a NodeZero Rapid Response test.
By Horizon3 · horizon3.ai
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.