Vulnerability in Cisco Finesse

[ Description ]Official description

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain limited sensitive information for services that are associated with the affected device.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• CERT-FR8 Oct 2026CERTFR-2026-AVI-1282

  Multiple vulnerabilities in Cisco products Translated from French

  Multiple vulnerabilities have been discovered in Cisco products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

  CVE-2026-76471CVE-2026-76455CVE-2026-76482+27 more CVEs
• BSI CERT-Bund7 Oct 2026WID-SEC-2026-3794

  Cisco Finesse, Unified CCE, Unified CCX: Vulnerability allows information disclosure Translated from German

  CVE-2026-20362

[ References ]References

• sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-…