Cisco Fixes Unauthenticated SSRF Vulnerability in Finesse Server Management Interface

Cisco Systems has published a security advisory addressing a high-severity server-side request forgery (SSRF) vulnerability in its Cisco Finesse contact center application. The flaw, identified as CVE-2026-20362, affects the web-based management interface and can be exploited by unauthenticated, remote attackers to access sensitive information.

The vulnerability stems from improper input validation for specific HTTP requests directed at the management interface. According to the Cisco Product Security Incident Response Team (PSIRT), an attacker can exploit this issue by sending a crafted HTTP request to an affected device. A successful exploitation allows the attacker to conduct SSRF attacks, potentially obtaining limited sensitive information for services associated with the affected device. Cisco has assigned a High security impact rating to this vulnerability.

Technical Context and Impact

Server-side request forgery vulnerabilities typically allow attackers to force a server to make requests to internal or external resources that it should not access. In this specific case, the lack of proper input validation enables the attacker to manipulate HTTP requests through the web-based management interface.

The advisory notes that the information an attacker can obtain is limited to services associated with the affected device. While the advisory does not specify the exact nature of the sensitive data, SSRF flaws often expose internal network topology, metadata services, or other backend systems that are not directly accessible from the internet. The unauthenticated nature of the exploit means that an attacker does not need valid credentials to attempt the attack, significantly lowering the barrier to entry for potential exploitation.

Who Is Affected

This vulnerability specifically impacts organizations using Cisco Finesse, a component of Cisco’s contact center portfolio. Finesse provides agent desktop functionality for contact centers, allowing agents to interact with customers via voice, email, and other channels. The vulnerability resides in the web-based management interface, which administrators use to configure and manage the Finesse server.

Any deployment of Cisco Finesse that has not yet received the upcoming software update is considered affected. Because the attack vector is remote and unauthenticated, any instance of the management interface exposed to the internet or accessible from untrusted networks is at risk. Organizations that have segmented their management interfaces or restricted access via firewalls may have reduced exposure, but the fundamental vulnerability remains present in the software code.

What should you do?

Cisco has announced plans to release software updates that address this vulnerability. However, the advisory explicitly states that there are no workarounds that address this vulnerability. This means that administrators cannot mitigate the risk through configuration changes, feature disabling, or other temporary measures until the official patch is available.

Security professionals should monitor the Cisco Security Advisory page for the release of the fix. Once the update is available, organizations should prioritize its deployment, particularly for any Finesse servers with management interfaces accessible from untrusted networks. Until the patch is applied, the only way to fully mitigate the risk is to restrict network access to the management interface, although this is not listed as an official workaround in the advisory.