Cisco Finesse Server-Side Request Forgery Vulnerability

Description

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain limited sensitive information for services that are associated with the affected device. Cisco plans to release software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-ssrf-mmSuyugS Security Impact Rating: High CVE: CVE-2026-20362

What to do

Install the fixed versions listed in the official advisory. If you cannot update right away, apply the workarounds or mitigations it describes and limit access to the affected service.

Details

Vendor

Cisco

Product

Cisco Finesse

CVE

CVE-2026-20362

Affected versions

Cisco Finesse 12.6: 22 versions, from 12.6(1) to 12.6(2)ES8
Cisco Finesse 15.0: 6 versions, from 15.0(1) to 15.0(1)SU2 (from the advisory and NVD; check the exact builds in the official advisory)

CVSS score

7.2

Actively exploited

Not known at this time

Source

Cisco PSIRT – original advisory

Published

October 29, 2026

The description and the recommended action are quoted from the public advisory (the action is our generic advice); severity, exploitation status and affected versions are compiled automatically from public sources and may contain errors. The vendor's original advisory prevails: check it before taking action. This information is provided without warranty and does not replace a professional assessment.