CVE-2026-20362 | Cisco Finesse Server-Side Request Forgery Vulnerability

What it is

CVE-2026-20362 is an unauthenticated server-side request forgery in the Cisco Finesse web interface, rated CVSS 3.1 7.2 (High). Horizon3 researchers Noah King and Brandon Peterson found it. The page says it affects Finesse regardless of configuration. Cisco Unified Intelligence Center is not affected.

How it works

The cause is improper input validation in the embedded Apache Shindig content proxy. The proxy fetches an attacker-supplied URL and returns the response to the unauthenticated caller. Requests can target loopback-only or internal services. The example given is the Finesse REST API at 127.0.0.1:8082, whose SystemInfo response lists the deployment type, primary and secondary node hostnames, and the XMPP domain. The page describes the impact as infrastructure enumeration and limited sensitive information from services not reachable from outside.

Preconditions / Affected

The attacker needs network access to the Finesse web interface. No authentication or user interaction is required.

What to do

Cisco lists no workaround, and no fixed release existed as of 27 October 2026. Cisco's planned fixes are scheduled for January and February 2027. The page's version table did not come through, so check Cisco's advisory for the exact releases.

Until then, Horizon3 recommends:

• Restrict the Finesse web interface to trusted networks or authenticated VPN connections.
• Monitor for unexpected requests from Finesse servers to internal services.
• Optionally, run the NodeZero Rapid Response test Horizon3 released on 27 October 2026 to check exploitability. Re-run it after restricting access, and again after patching.

Caveats

Older branches must migrate to a fixed release. Upgrading to an affected 15.0 release does not resolve the flaw. Access restrictions and monitoring reduce exposure but do not correct the flaw. Cisco PSIRT reports no known malicious use as of 27 October 2026. Cisco published its advisory and NVD published the record on 7 October 2026.