Cisco Finesse SSRF lets unauthenticated attackers forge requests to access sensitive data
An unauthenticated remote attacker can exploit improper input validation in Cisco Finesse to forge server-side requests and access limited sensitive data.
Key points
- Cisco Finesse web management interface has a server-side request forgery vulnerability.
- The flaw allows unauthenticated remote attackers to send crafted HTTP requests.
- Cisco rates the security impact as high and plans to release software updates.
Cisco has confirmed a high-severity vulnerability in its Finesse contact center software that allows remote attackers to access sensitive information without authentication. The flaw exists in the web-based management interface and stems from improper input validation of specific HTTP requests.
In plain English
Server-side request forgery, or SSRF, is a type of security flaw that tricks a server into making requests on behalf of an attacker. Normally, a server only talks to other systems it is authorized to communicate with. In this case, the Cisco Finesse server fails to properly check the data inside certain incoming web requests.
An attacker can send a specially crafted HTTP request to the affected device. Because the server does not validate this input correctly, it processes the request as if it were legitimate. This allows the attacker to force the server to interact with other services associated with the device. The result is that the attacker can obtain limited sensitive information from those internal services.
The background
Cisco Finesse is a software solution designed for contact centers, helping manage customer interactions and agent workflows. The management interface for this software is accessible via the web, which makes it a potential target for remote attacks if not properly secured.
The vulnerability is tracked as CVE-2026-20362. Cisco’s Product Security Incident Response Team (PSIRT) issued an advisory detailing the issue. The company states that the vulnerability is due to improper input validation for specific HTTP requests within the web-based management interface.
What changes now
Cisco has rated the security impact of this vulnerability as high. This rating reflects the fact that an attacker does not need to log in or have any credentials to exploit the flaw. The attack can be conducted remotely, meaning the attacker does not need to be inside the organization’s network.
Currently, there are no workarounds that address this vulnerability. Cisco has stated that it plans to release software updates that address the issue. Until those updates are available, the vulnerability remains active in affected installations. Organizations using Cisco Finesse should monitor for the release of these patches.
What to do and how to stay safe: Cisco
- Review network logs for unusual HTTP requests originating from or targeting the Finesse management interface.
- Restrict access to the Finesse web management interface to trusted internal networks only, if possible.
- Monitor for any unexpected outbound connections from the Finesse server to internal services or external endpoints.
- Prepare to apply the software update once Cisco releases it to address the input validation flaw.
Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed
General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for this vulnerability?
The vulnerability is identified as CVE-2026-20362.
Is there a workaround available right now?
No, there are no workarounds that address this vulnerability at this time.
What can an attacker do with this flaw?
An unauthenticated, remote attacker can obtain limited sensitive information for services associated with the affected device.
