A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct server-side… (CVE-2026-20362)

CVE-2026-20362 describes an SSRF vulnerability in Cisco Finesse's web-based management interface. The flaw stems from improper input validation of certain HTTP requests, enabling unauthenticated remote attackers to send crafted requests that may cause the server to perform unintended requests internally. Successful exploitation can disclose limited sensitive information about services associated with the device. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope change, and partial confidentiality and integrity impact. No vendor advisory or patch details are provided in the input.

An attacker can remotely exploit this vulnerability without authentication to conduct SSRF attacks, potentially gaining limited sensitive information about internal services of the affected Cisco Finesse device. There is no indication of impact on availability. The vulnerability could facilitate further attacks or reconnaissance but does not directly allow system compromise or denial of service based on the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround information is provided in the available data. Until a patch is available, monitor vendor communications for updates.