DEV Community

kozhevniko
kozhevniko

Posted on

A Disclosed SSRF and a 2027 Patch Date: Running Cisco Finesse Without a Vendor Fix

#security

A Disclosed SSRF and a 2027 Patch Date: Running Cisco Finesse Without a Vendor Fix

Most vulnerability advice ends with "apply the vendor update." Cisco Finesse breaks that routine: the fixed releases are scheduled for January and February 2027.

What is affected

CVE-2026-20362 is an unauthenticated server-side request forgery flaw in the Finesse web-based management interface, rated 7.2 on CVSS v3. Cisco attributes it to improper input validation for specific HTTP requests. A crafted request makes the server issue requests on the attacker's behalf, and the advisory notes the attacker could "obtain limited sensitive information for services that are associated with the affected device." The CVSS vector marks scope as changed.
Finesse is the agent desktop for Cisco contact center platforms, and it also ships inside Packaged CCE, Unified CCE and Unified CCX. The advisory states the issue applies regardless of device configuration, and that a public announcement is available.

The calendar problem

Cisco lists fixed releases as Finesse 15.0(1) SU3 in February 2027, Packaged CCE and Unified CCE 15.0(1)ES202701 in January 2027, and Unified CCX 15.0(1) SU2 in February 2027. Version 12.6 and earlier must migrate. Cisco also states there are no workarounds. That combination leaves administrators with compensating controls rather than a fix.

What to do in the meantime

Keep the Finesse web interface off untrusted networks. Monitor outbound requests from Finesse for destinations the contact center has no reason to call, since SSRF shows up as unexpected egress. Treat reachability to the management interface as the deciding control, and record the accepted risk with an owner and a review date. Cisco reports no malicious use so far.

References

Limits

Fix dates come from the vendor advisory. Scheduling changes are common, so re-check before relying on them.

Top comments (0)