CVE-2026-20362: Cisco Finesse SSRF, Affected Versions and the 2027 Fix Plan

Direct answer

CVE-2026-20362 is an unauthenticated Cisco Finesse SSRF flaw rated CVSS v3.1 7.2. Cisco says it can expose limited sensitive information from services associated with an affected device. There is no official workaround and no known malicious use reported by Cisco. Planned fixes are January or February 2027 for current 15.0 branches; older branches must migrate.

What Cisco disclosed on October 7

Cisco’s PSIRT advisory identifies CVE-2026-20362 as a vulnerability caused by improper input validation for specific HTTP requests. A remote attacker does not need to authenticate to send a crafted request to an affected device, according to the vendor. If exploitation succeeds, the stated outcome is limited sensitive information from services associated with that device—not an unrestricted promise of access to every connected system.

The advisory was first published on October 7, 2026 at 16:00 GMT and marked as a final version 1.0 advisory. That timing matters: an October 8 independent report is follow-up coverage, not the original disclosure. The independent report is useful as a cross-check of the product context and planned-fix gap, while Cisco remains the controlling source for affected and fixed software. Source label: Cisco PSIRT advisory; independent cross-check: SecurityOnline, October 8, 2026.

How serious is CVE-2026-20362?

Cisco assigns the vulnerability a CVSS v3.1 base score of 7.2, in the High range. The published vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N.

In plain language, the score reflects a network-reachable attack, low complexity, no required privileges, and no user interaction. The vector also marks changed scope, which is consistent with the possibility that information associated with the affected device could be exposed beyond the Finesse component itself. The confidentiality and integrity impacts are rated low, while availability is rated none in the vector.

A CVSS score is a severity measure, not a count of incidents or a prediction that every deployment will be compromised. It does not establish that a particular organization has been attacked. Cisco says its PSIRT is not aware of malicious use of the vulnerability. Public disclosure can still justify prompt exposure review, especially where a Finesse interface is reachable from untrusted networks.

What an SSRF flaw means here

Server-side request forgery occurs when an application can be induced to make a request on behalf of someone outside the application’s intended trust boundary. In this case, Cisco describes the issue at the level needed for defenders: improper validation of specific HTTP requests through the Finesse web-based management interface, followed by possible access to limited information from associated services.

That description is intentionally narrower than claims of remote code execution, full server takeover, or broad data theft. Neither the Cisco advisory nor the independent report establishes those outcomes for this CVE. Avoid treating “associated services” as a complete inventory of reachable systems; the advisory does not publish a victim list, a confirmed data set, or a universal impact statement for every deployment.

This article also does not reproduce exploit requests or paths. Administrators can assess exposure, access controls, logs, and outbound behavior without turning a public explanation into an operational attack recipe.

Which Cisco products are affected?

Cisco says the vulnerability affects Cisco Finesse regardless of device configuration. It also says that Cisco products bundled with Finesse may be affected. The authoritative branch-level status in the advisory is:

Cisco explicitly confirms that Cisco Unified Intelligence Center is not affected. That is a product-status statement, not a conclusion that every other contact-center component is independently vulnerable. Teams should map the installed platform and release against Cisco’s advisory rather than infer status from a product name, a bundle label, or a neighboring application.

• Product or product family: Cisco Finesse; Affected branch identified by Cisco: 12.6 and earlier; First fixed release listed by Cisco: Migrate to a fixed release
• Product or product family: Cisco Finesse; Affected branch identified by Cisco: 15.0; First fixed release listed by Cisco: 15.0(1) SU3, planned February 2027
• Product or product family: Cisco Packaged CCE and Unified CCE; Affected branch identified by Cisco: Earlier than 15.0; First fixed release listed by Cisco: Migrate to a fixed release
• Product or product family: Cisco Packaged CCE and Unified CCE; Affected branch identified by Cisco: 15.0; First fixed release listed by Cisco: 15.0(1)ES202701, planned January 2027
• Product or product family: Cisco Unified CCX; Affected branch identified by Cisco: 12.5 and earlier; First fixed release listed by Cisco: Migrate to a fixed release
• Product or product family: Cisco Unified CCX; Affected branch identified by Cisco: 15.0; First fixed release listed by Cisco: 15.0(1) SU2, planned February 2027

What “planned for 2027” means

The dates in the table are planned first fixed releases, not patches that were already available on October 8, 2026. Cisco lists Finesse 15.0(1) SU3 for February 2027, Packaged CCE and Unified CCE 15.0 15.0(1)ES202701 for January 2027, and Unified CCX 15.0 15.0(1) SU2 for February 2027.

Release planning can change, and Cisco’s advisory is the place to recheck the status before scheduling an upgrade. A branch marked “migrate to a fixed release” does not have a version-specific patch listed in this advisory. That means an organization on Finesse 12.6 or earlier, CCE earlier than 15.0, or Unified CCX 12.5 or earlier should begin a supported migration plan rather than wait for a same-branch service update.

Do not describe any of these 2027 targets as “released,” “available,” or “installed fixes.” Until the relevant software is published and validated for the deployment, the risk remains an open patch-management issue.

Is there an official workaround?

No. Cisco’s advisory says no workarounds are available that address this vulnerability. That is different from saying an operator has no risk-reduction options at all.

Restricting the Finesse management interface to trusted administrative networks, reducing unnecessary exposure, enforcing appropriate network segmentation, and monitoring for anomalous requests or unexpected outbound connections are sensible defensive controls. They may reduce the opportunity or potential blast radius, but they are not Cisco-confirmed workarounds and do not remediate the input-validation flaw.

Avoid presenting access restriction as a vendor-tested fix, and do not assume that a reverse proxy, authentication gateway, or firewall rule blocks every relevant request unless the deployment owner has validated that control against the actual architecture. Keep the distinction clear in change records: “temporary exposure reduction” is not “vulnerability fixed.”

What should teams tell leadership?

The clearest risk statement is precise: this is a publicly disclosed, high-severity, unauthenticated SSRF vulnerability affecting Finesse and some bundled contact-center product branches; the vendor has no official workaround, and its first fixes are planned for 2027. Cisco has not reported known malicious use.

That statement supports funding and scheduling decisions without overstating the evidence. Leadership should understand that “no known malicious use” is an observation at the time of the advisory, not a guarantee that no probing will occur. Conversely, public disclosure is not evidence that the organization has suffered a breach. The immediate objective is to identify exposed deployments, reduce unnecessary access, improve visibility, and be ready to validate the correct fixed release.

Two questions administrators commonly ask

Question: Is Cisco Unified Intelligence Center affected?

Cisco explicitly says no: Unified Intelligence Center is confirmed not vulnerable in this advisory. That conclusion applies to the named product and should not be generalized to other Cisco contact-center components without checking their own status and software relationships.

Question: Can an organization on an older branch wait for a backport?

Cisco’s advisory does not list a same-branch backport for Finesse 12.6 and earlier, CCE releases earlier than 15.0, or Unified CCX 12.5 and earlier. It says to migrate to a fixed release. Owners should therefore plan a supported migration and confirm the applicable path with their Cisco support channel rather than assume an older-branch patch will arrive.

Limitations and evidence boundaries

This article reflects the Cisco advisory and the independent SecurityOnline report reviewed on October 8, 2026. Cisco is authoritative for the CVSS rating, affected and fixed release information, workaround status, Unified Intelligence Center status, and its statement about known malicious use. The independent report corroborates the public-disclosure context and repeats the planned release schedule, but it does not add evidence of exploitation or confirmed victims.

The available sources do not establish a victim count, confirmed compromise, stolen records, a complete list of reachable associated services, or a working exploit. They also do not establish that network restriction is a vendor-validated workaround. Recheck Cisco’s current advisory and release availability before publication or operational change approval.

Decision checklist

• Inventory the deployment. Record whether the environment uses Cisco Finesse, Packaged CCE, Unified CCE, or Unified CCX, and capture the exact major, minor, service-update, and engineering-release identifiers.
• Map bundled dependencies. Identify which contact-center services are associated with each Finesse device and what information the interface can reach under normal operations. Treat this as an architecture exercise, not proof that all associated services are exposed.
• Confirm management-plane exposure. Verify whether the Finesse web interface is reachable from the public internet, partner networks, broad corporate segments, or only a controlled administrator network. Remove unnecessary reachability where operationally safe.
• Review access controls and segmentation. Limit administrative access to approved sources, protect management paths with existing enterprise controls, and document exceptions for remote support or integrations.
• Increase monitoring. Review web, reverse-proxy, firewall, and network telemetry for unusual unauthenticated requests, unexpected destinations, or access patterns that do not fit normal Finesse administration. Preserve relevant logs with timestamps and source details.
• Prepare the upgrade. Confirm support contracts, maintenance windows, backup and rollback procedures, compatibility requirements, and the validation plan for the first fixed release applicable to the product branch.
• Track Cisco’s advisory. Recheck the advisory for revisions, release availability, and any updated product guidance before calling the issue remediated.
• Escalate suspicious evidence. If monitoring shows unexplained access or data movement, follow the organization’s incident-response process and preserve evidence. The existence of the CVE alone does not prove compromise.

Limitations

• Evidence was reviewed on 8 October 2026; advisories, telemetry and package status can change.
• General defensive guidance is not a diagnosis of a particular system or a guarantee of complete cleanup.
• Capabilities, exposure and sensor attempts do not alone establish confirmed data theft or a customer breach.
• Source guidance and indicators must be rechecked before making operational decisions.

Evidence sources

1. Cisco PSIRT — Cisco PSIRT advisory, “Cisco Finesse Server-Side Request Forgery Vulnerability”
2. SecurityOnline — SecurityOnline, “Cisco Finesse SSRF Flaw CVE-2026-20362 Publicly Disclosed, With Fixes Not Due Until 2027”