CVE-2026-20362: Cisco Finesse Server-Side Request Forgery Vulnerability
A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain limited sensitive information for services that are associated with the affected device.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can attempt exploitation by sending a crafted HTTP request to the affected Cisco Finesse web-based management interface. No prior privileges or user interaction are required.
What is the likely impact of a successful exploit?
Successful exploitation allows server-side request forgery and may expose limited sensitive information from services associated with the affected device. The provided information does not indicate an availability impact.
What condition makes an environment exposed?
Exposure requires an affected Cisco Finesse instance with its web-based management interface reachable by an attacker. The vulnerability is triggered through specific HTTP requests that are not properly input-validated.