Cisco Security Advisory · October 7, 2026
Cisco Finesse has an unauthenticated SSRF with no current workaround
CVE-2026-20362 affects Cisco Finesse and products that bundle it. Cisco says there is no workaround; fixed releases are scheduled for January and February 2027.
Check whether your deployment includes Cisco Finesse. Cisco says the vulnerability affects Finesse regardless of device configuration, including Packaged CCE, Unified CCE, and Unified CCX when bundled with Finesse. The advisory describes an unauthenticated remote SSRF that may disclose limited sensitive information from services associated with the device. Cisco reports no workaround and says PSIRT is not aware of malicious use as of the advisory publication.
| Product / release | Cisco-listed status | First fixed release or action |
|---|---|---|
| Cisco Finesse 12.6 and earlier | Affected | Migrate to a fixed release; Cisco does not name a target version for these branches. |
| Cisco Finesse 15.0 | Affected | 15.0(1) SU3, scheduled February 2027. |
| Packaged CCE / Unified CCE earlier than 15.0 | Affected | Migrate to a fixed release. |
| Packaged CCE / Unified CCE 15.0 | Affected | 15.0(1)ES202701, scheduled January 2027. |
| Unified CCX 12.5 and earlier | Affected | Migrate to a fixed release. |
| Unified CCX 15.0 | Affected | 15.0(1) SU2, scheduled February 2027. |
What the advisory establishes
Cisco attributes the flaw to improper input validation in specific HTTP requests to the web-based management interface. The advisory does not name those requests, publish the vulnerable code, or provide a source diff. It says a crafted request could let an unauthenticated remote attacker make the device issue SSRF requests and obtain limited sensitive information from associated services. Do not infer arbitrary file access, command execution, or a particular internal target from this description.
What administrators can do now
- Inventory Cisco Finesse directly and through Packaged CCE, Unified CCE, and Unified CCX deployments; Cisco says configuration does not remove exposure.
- Record the exact product family and release, then track the corresponding Cisco fixed-release schedule above. Older branches require migration to a fixed release.
- Cisco lists no workaround. Do not treat a firewall rule or interface restriction as a vendor-approved mitigation; consult Cisco TAC or your support provider for environment-specific interim controls.
- After Cisco publishes the fixed software, upgrade to the release for your product branch and verify the installed build against the advisory.
- If investigating possible exposure, preserve relevant device and associated-service logs and follow your incident-response process. Cisco has not reported malicious exploitation as of the advisory publication.