Skip to content
High-Severity SSRF Vulnerability in Cisco Finesse Disclosed

High-Severity SSRF Vulnerability in Cisco Finesse Disclosed

First seen 28 Oct 2026, 14:44 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 28, 2026 at 16:11 UTC
  • •CVE-2026-20362 is a high-severity SSRF vulnerability in Cisco Finesse.
  • •Unauthenticated attackers can exploit this flaw to access sensitive internal information.
  • •Patches are scheduled for release in early 2027, with no known exploitation reported yet.

A high-severity server-side request forgery (SSRF) vulnerability, CVE-2026-20362, has been identified in Cisco Finesse's web-based management interface. This flaw allows unauthenticated remote attackers to send crafted HTTP requests through the server, potentially exposing sensitive information from internal services. The vulnerability, discovered by Horizon3 researchers, has a CVSS score of 7.2 and affects all configurations of Cisco Finesse. Cisco has reported no known exploitation at this time, but fixes are scheduled for January and February 2027. The issue arises from improper input validation in the embedded Apache Shindig content proxy, which can access internal services like the Finesse REST API. Organizations are advised to restrict access to the Finesse interface while awaiting patches.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-07
CVE-2026-20362 published
Cisco disclosed a high-severity SSRF vulnerability affecting Cisco Finesse.
Horizon3.Ai

More articles in this cluster (4)

Following this threat?

Track Cisco and CVE-2026-20362 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (6)

1 / 3

Common questions

What is CVE-2026-20362?
CVE-2026-20362 is a high-severity SSRF vulnerability in Cisco Finesse that allows unauthenticated attackers to access sensitive internal information.
When will patches be available?
Cisco plans to release patches for this vulnerability in January and February 2027.
How can I protect my systems now?
Restrict access to the Finesse web interface to trusted networks or authenticated VPN connections until patches are released.