CVE-2026-20362: Server-Side Request Forgery (SSRF) in Cisco Cisco Finesse

This vulnerability exists due to improper input validation in the HTTP request handling of Cisco Finesse's web management interface. An unauthenticated attacker can exploit this by sending specially crafted HTTP requests, resulting in server-side request forgery (SSRF). The SSRF could allow the attacker to access limited sensitive information from services linked to the affected device. The CVSS 3.1 base score is 7.2, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to confidentiality and integrity.

An attacker can remotely exploit this vulnerability without authentication to perform SSRF attacks, potentially obtaining limited sensitive information from internal services associated with the affected Cisco Finesse device. There is no indication of impact on availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the Cisco vendor advisory for current remediation guidance. Since no patch or workaround information is provided, administrators should monitor Cisco advisories for updates. Until a fix is available, restricting network access to the management interface and applying network-level controls to limit exposure may reduce risk.