CVE-2026-20362

highPriorität · verfolgen · 29EPSS 0.006 · 47. PerzentilDERUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.57% (47th) EPSS

CVSS 7.2 · high

Is it mine?

39 products

Prüfe deine Angriffsfläche

Who says so?

3 sources

fstec_bdu · cert_bund · cisco_csaf

EPSS · bewertet 2026-10-27

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain limited sensitive information for services that are associated with the affected device.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

Behoben12.6(1)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben12.6(1)ES1cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben12.6(1)ES10cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben12.6(1)ES11cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben12.6(1)ES2cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben12.6(1)ES3cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben12.6(1)ES4cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben12.6(1)ES5cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben12.6(1)ES6cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben12.6(1)ES7cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben12.6(1)ES7_ETcisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben12.6(1)ES8cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben12.6(1)ES9cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben12.6(2)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben12.6(2)ES1cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben12.6(2)ES2cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben12.6(2)ES3cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben12.6(2)ES4cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben12.6(2)ES5cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben12.6(2)ES6cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben12.6(2)ES7cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben12.6(2)ES8cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben15.0(1)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben15.0(1)ES202508cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben15.0(1)ES202511cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben15.0(1)ES202602cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben15.0(1)SU1cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Behoben15.0(1)SU2cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
BehobenCisco Unified Contact Center Expresscisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.2

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.6–7.2

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:Nprimary · psirt@cisco.com USAusnutzbarkeit 3.9 · Auswirkung 2.7

v3.17.2highAV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:Nsecondary · FSTEC (BDU) RU

v3.16.6mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:Nsecondary · Cisco PSIRT US

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-918USCWE-918US

betroffene Produkte (39)

Betroffene Produkte und Versionsbereiche.

Cisco Finesse <15.0(1) SU3alle Versionencert_bundDE
Cisco Unified Contact Center Enterprise <15.0(1)ES202701alle Versionencert_bundDE
Cisco Unified Contact Center Express (UCCX) <15.0(1) SU2alle Versionencert_bundDE
Cisco Finesse< 15.0(1) SU3cert_bundDE
Cisco Unified Contact Center Enterprise< 15.0(1)ES202701cert_bundDE
Cisco Unified Contact Center Express (UCCX)< 15.0(1) SU2cert_bundDE
Cisco 12.6(1)alle Versionencisco_csafUS
Cisco 12.6(1)ES1alle Versionencisco_csafUS
Cisco 12.6(1)ES10alle Versionencisco_csafUS
Cisco 12.6(1)ES11alle Versionencisco_csafUS
Cisco 12.6(1)ES2alle Versionencisco_csafUS
Cisco 12.6(1)ES3alle Versionencisco_csafUS
Cisco 12.6(1)ES4alle Versionencisco_csafUS
Cisco 12.6(1)ES5alle Versionencisco_csafUS
Cisco 12.6(1)ES6alle Versionencisco_csafUS
Cisco 12.6(1)ES7alle Versionencisco_csafUS
Cisco 12.6(1)ES7_ETalle Versionencisco_csafUS
Cisco 12.6(1)ES8alle Versionencisco_csafUS
Cisco 12.6(1)ES9alle Versionencisco_csafUS
Cisco 12.6(2)alle Versionencisco_csafUS

20 von 39 angezeigt

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

WID-SEC-W-2026-3794Cisco Finesse, Unified CCE, Unified CCX: Schwachstelle ermöglicht Offenlegung von InformationenDeutsch2026-10-07csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Cisco Finesse, Unified CCE und Unified CCX ausnutzen, um Informationen offenzulegen, indem er Server-Side Request Forgery (SSRF)-Angriffe durchführt.
cisco-sa-finesse-ssrf-mmSuyugSCisco Finesse Server-Side Request Forgery Vulnerability2026-10-07csaf · cisco_csafUS
A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain limited sensitive information for services that are associated with the affected device. Cisco plans to release software updates that address this vulnerability. There are no workarounds that address this vulnerability.

auch bekannt als (1)

Weitere Namen und Kennungen dieser Entität.

BDU:2026-16200 fstec_bdu

quellen

Welche Quellen diesen Datensatz belegen und wann.

fstec_bdu cert_bund cisco_csaf NVD CVE.org MITRE

veröffentlicht 2026-10-07geändert 2026-10-12

Referenzen (1) nvd

Externe Belege — Patches, Meldungen, Analysen.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-ssrf-mmSuyugS

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan