VULNpocalypse
HighVulnerabilityOngoing

Cisco Finesse CVE-2026-20362 SSRF, Horizon3 reports unpatched flaw

Horizon3 reports an unauthenticated SSRF in Cisco Finesse with fixes due in 2027; restrict the web interface to trusted networks or VPN until patched.

Published
Fixed in
No fix released yet, planned Finesse 15.0(1) SU3, Packaged and Unified CCE 15.0(1)ES202701, Unified CCX 15.0(1) SU2
Exploitation
No, Horizon3 says Cisco PSIRT reports no known malicious use

Live scores

CVE-2026-20362
EPSS
0.006
low predicted chance of attack
VEDAS
0.053
little exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

What happened

According to Horizon3, CVE-2026-20362 is a server-side request forgery (SSRF, CWE-918) vulnerability in the web-based management interface of Cisco Finesse. Horizon3 says an unauthenticated remote attacker can send crafted HTTP requests through an affected server to obtain limited sensitive information from associated services, and rates it CVSS v3.1 7.2 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N.

Horizon3 reports that its researchers Noah King and Brandon Peterson found the flaw, and that it affects Finesse regardless of configuration. Horizon3 says Cisco published its advisory on October 7, 2026, credited the researchers and announced planned fixed releases, and that NVD published the record the same day. The Cisco advisory itself was not available among the sources for this advisory, so these details come from Horizon3’s summary of it.

Horizon3 identifies the embedded Apache Shindig content proxy as the affected component. According to Horizon3, the proxy fetches an attacker-supplied URL from the server and returns the response to the unauthenticated caller. Horizon3 says this can reach loopback-only or internal services. Its example is the Finesse REST API at 127.0.0.1:8082, whose SystemInfo response exposes the deployment type, primary and secondary node hostnames, and XMPP domain.

Exploitation status: Horizon3 says Cisco PSIRT reports no known malicious use. No independent confirmation of exploitation is in the sources.

Am I affected?

According to Horizon3, the affected release families are:

  • Cisco Finesse: 12.6 and earlier, and 15.0
  • Cisco Packaged Contact Center Enterprise and Unified Contact Center Enterprise: earlier than 15.0, and 15.0
  • Cisco Unified Contact Center Express: 12.5 and earlier, and 15.0

Horizon3 says Cisco Unified Intelligence Center is not affected. Exploitation requires network access to the Finesse web interface but no authentication and no user interaction, per Horizon3.

What to do now

  1. Restrict access to the Finesse web interface to trusted networks or authenticated VPN connections. Horizon3 says Cisco lists no workaround that fixes the flaw, so this only reduces exposure (Horizon3).
  2. Monitor for unexpected requests from Finesse servers to internal services, as Horizon3 recommends (Horizon3).
  3. Plan upgrades to the fixed releases Horizon3 says Cisco has scheduled. As of October 27, 2026, none was available: Finesse 15.0(1) SU3 (February 2027), Packaged CCE and Unified CCE 15.0(1)ES202701 (January 2027), Unified CCX 15.0(1) SU2 (February 2027) (Horizon3).
  4. If you run an older branch, plan a migration. Horizon3 says older branches require migration to a fixed release and that upgrading to an affected 15.0 release does not resolve the issue (Horizon3).
  5. Check Cisco’s advisory and the NVD record for updated fix availability. Release dates are planned, not confirmed.

Sources