What’s Vulnerable › Vulnerabilities

CVE-2026-20362: Cisco Finesse Server-Side Request Forgery Vulnerability

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-07 · updated 2026-10-08
• Weakness: CWE-918

Description

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain limited sensitive information for services that are associated with the affected device.

Affected products

• Cisco Finesse: 12.6(1), 12.6(1)ES1, 12.6(1)ES2, 12.6(1)ES3, 12.6(1)ES4, 12.6(1)ES5 (+22)

In the news

• CVE-2026-20362 | Cisco Finesse Server-Side Request Forgery Vulnerability
• Cisco Finesse Server-Side Request Forgery Vulnerability

References

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-ssrf-mmSuyugS

Get alerted when CVE-2026-20362 or the next vulnerability affects your stack