Cisco Finesse SSRF Flaw CVE-2026-20362 Publicly Disclosed, With Fixes Not Due Until 2027
Do Son 
TL;DR
Cisco has disclosed CVE-2026-20362, an unauthenticated server-side request forgery (SSRF) flaw in Finesse rated 7.2 on CVSS. Details of this Cisco Finesse vulnerability are already public, yet fixed releases will not ship until January and February 2027. There are no workarounds.
- CVE: CVE-2026-20362
- CVSS: 7.2 (High · CVSSv3)
- Product: Cisco Finesse
- Affected: 12.6(1), 12.6(1)ES1, 12.6(1)ES2, 12.6(1)ES3, 12.6(1)ES4, 12.6(1)ES5 (+22 more)
- Impact: Cisco Finesse Server-Side Request Forgery Vulnerability
- Status: No confirmed exploitation yet
- Action: See vendor advisory
Turn Cisco CVEs into GitHub Issues automatically — no copy-pasting, no duplicates.
Try Team free for 14 daysWhy It Matters
Finesse is the agent desktop for Cisco contact center platforms. It also ships inside Packaged CCE, Unified CCE and Unified CCX. Notably, the Cisco security advisory confirms that “a public announcement is available” for the bug. However, Cisco “is not aware of any malicious use” so far. The gap between public details and patches is what makes this case unusual.
How the Attack Works
The flaw lives in the web-based management interface. Cisco says it is “due to improper input validation for specific HTTP requests.” An unauthenticated attacker sends a crafted request, and the server then makes requests on the attacker’s behalf. As a result, the attacker could “obtain limited sensitive information for services that are associated with the affected device.” The CVSS vector marks the scope as changed, so the impact can reach systems beyond Finesse itself. Noah King and Brandon Peterson of Horizon3 reported the issue.
Affected Versions
This Cisco Finesse vulnerability affects the product “regardless of device configuration.” Fixed releases are scheduled as follows:
- Finesse 15.0: 15.0(1) SU3 (Feb 2027). Version 12.6 and earlier must migrate.
- Packaged CCE and Unified CCE 15.0: 15.0(1)ES202701 (Jan 2027)
- Unified CCX 15.0: 15.0(1) SU2 (Feb 2027). Version 12.5 and earlier must migrate.
Cisco Unified Intelligence Center is not affected.
Patch and Mitigation Steps
Plan upgrades to the listed releases once they ship. Until then, keep the Finesse web interface off untrusted networks and watch its outbound traffic for unusual requests. Those steps limit exposure to the Cisco Finesse vulnerability while fixes remain months away.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
