CVE-2026-20362

Executive Summary

CVE-2026-20362 is a server-side request forgery (SSRF) vulnerability in the web-based management interface of Cisco Finesse, caused by improper input validation of specific HTTP requests. An unauthenticated, remote attacker can send a crafted HTTP request to an affected device and, on success, obtain limited sensitive information about services associated with that device. The flaw carries a CVSS v3.1 base score of 7.2 and is currently unpatched according to tracked sources, with no public PoC, exploit code, or Nuclei template available.

Technical Analysis

The vulnerability resides in the web-based management interface of Cisco Finesse — a contact-center application that exposes administrative and configuration functionality over HTTP/HTTPS. The root cause, per the NVD description, is improper input validation for specific HTTP requests. This corresponds to CWE-918 (Server-Side Request Forgery): the application accepts attacker-influenced input that determines a server-side outbound request target, and it fails to adequately validate or restrict that target.

In SSRF-class vulnerabilities, the web interface typically processes a client-supplied value (for example a URL, hostname, or resource locator embedded in a request) and issues a server-originated request to the resulting destination. Because validation is inadequate, the attacker can influence where the request is directed. The provided description does not disclose the exact request parameter, endpoint, or URI path involved, so no specific parameter name, API path, or file path can be asserted here. What is derivable is the mechanism class: unauthenticated reachability of the management interface, attacker-controlled request input, insufficient validation, and server-side request initiation against services associated with the affected device.

The CVSS vector indicates network-only access (AV:N) with low attack complexity (AC:L) and no privileges (PR:N) or user interaction (UI:N) required. The scope change (S:C) reflects that the vulnerable component can affect resources beyond its own security authority — consistent with the server acting as a pivot to contact other associated services. Confidentiality and Integrity impacts are both Low (C:L/I:L), and there is no Availability impact (A:N), matching the NVD statement that exploitation yields only limited sensitive information disclosure rather than full compromise. No authentication is needed because the vulnerable surface is the pre-authentication HTTP request handling of the management interface.

There is currently no vendor fix, no patch source, and no affected-version list in the supplied data, so version-level precision cannot be provided. Patch confidence is 0/4 (unpatched across all tracked sources). No CISA KEV listing, no public exploit code, and no Nuclei template were observed, which lowers near-term exploitation likelihood but does not eliminate risk given the unauthenticated, low-complexity nature of the flaw.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the SSRF vulnerability class and the NVD description, not from a disclosed exploit.

1. Reconnaissance / target identification: The attacker locates internet- or intranet-reachable Cisco Finesse management interfaces, for example via Shodan/censys-style discovery of the Finesse login/management pages. Targets of interest are Finesse deployments reachable by the attacker, especially those sitting adjacent to internal services.

2. Triggering the flaw class: Because the vulnerability stems from improper input validation for specific HTTP requests and requires no authentication, the attacker sends a crafted HTTP request to the management interface in which the input governing a server-side request is manipulated. The precise parameter/endpoint is not disclosed in the available data; at the vulnerability-class level, the attacker supplies a destination value that the server fails to properly validate.

3. Payload/execution method (class level): The crafted request causes the Finesse server to initiate an outbound request to an attacker-influenced destination. Depending on reachability, this can be directed at services associated with the affected device — enabling the attacker to probe or retrieve limited information from those services, since responses or side effects are reflected back or otherwise observable. No specific URI scheme, header name, or query parameter is confirmed by the source data and none is asserted here.

4. Post-exploitation impact: Per the NVD description, successful exploitation allows the attacker to obtain limited sensitive information for services associated with the affected device. The impact is bounded to Low confidentiality and Low integrity per the CVSS vector — this is information-gathering and potential limited manipulation of related services, not full system takeover. The scope change implies the effect can extend beyond the Finesse component to associated services. There is no availability impact.

Impact Assessment

Business impact centers on information disclosure. An unauthenticated attacker able to reach a Finesse management interface can abuse the server as a request proxy toward associated services, potentially leaking limited internal service information that would otherwise be unreachable. For contact-center environments, Finesse often interfaces with telephony and agent-facing infrastructure, so leaked details about associated services can feed follow-on reconnaissance or lateral targeting.

Affected systems: Cisco Finesse web-based management interfaces. The supplied data does not enumerate specific software versions, so asset owners must treat all exposed Finesse management interfaces as potentially affected until Cisco confirms scope.

Blast radius: CVSS subscores — AV:N (remote), AC:L (no special conditions), PR:N (unauthenticated), UI:N (no user action), S:C (scope change, impact can cross a security boundary to related services), C:L / I:L (limited confidentiality and integrity), A:N (no availability impact). Base score 7.2 (High). EPSS is not yet scored by FIRST.org, so no probabilistic exploitation forecast is available; the absence of KEV listing, PoC, and exploit code currently indicates no confirmed in-the-wild exploitation.

Detection Guidance

Sigma Rule

title: Cisco Finesse SSRF Attempt via Crafted HTTP Request
id: 3f9c1e2a-7b64-4d2a-9c1e-0a6b5d2f9c11
status: experimental
description: Detects potential server-side request forgery attempts against the Cisco Finesse web-based management interface (CVE-2026-20362).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-20362
author: Valters IT Threat Intelligence
date: 2026-01-01
tags:
  - attack.t1190
  - cve.2026-20362
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|contains:
      - '/finesse'
      - '/admin'
  selection_ssrf:
    cs-uri-query|contains:
      - 'http://'
      - 'https://'
      - 'file://'
      - 'gopher://'
      - '169.254.169.254'
      - '127.0.0.1'
      - 'localhost'
  condition: selection_uri and selection_ssrf
falsepositives:
  - Legitimate administrative configuration referencing internal URLs
level: high

YARA Rule

rule CVE_2026_20362_Cisco_Finesse_SSRF
{
    meta:
        description = "Detects SSRF-oriented request artifacts targeting Cisco Finesse (CVE-2026-20362)"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-20362"
        date = "2026-01-01"
        cve = "CVE-2026-20362"
    strings:
        $a = "Cisco Finesse" ascii nocase
        $b = "/finesse" ascii nocase
        $c = "169.254.169.254" ascii
        $d = "gopher://" ascii nocase
        $e = "http://127.0.0.1" ascii nocase
        $f = "http://localhost" ascii nocase
    condition:
        $a or $b and any of ($c, $d, $e, $f)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-20362 Cisco Finesse SSRF Attempt"; flow:established,to_server; http.uri; content:"/finesse"; nocase; http.uri; content:"http"; nocase; distance:0; pcre:"/(http|https|gopher|file):\/\/(127\.0\.0\.1|localhost|169\.254\.169\.254)/Ui"; reference:cve,2026-20362; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-20362; classtype:attempted-recon; sid:202620362; rev:1;)

Elastic Detection

sequence by host.id with maxspan=1m
  [network where http.request.method in ("GET", "POST") and
     stringContains(http.request.uri, "/finesse")]
  [network where stringContains(http.request.uri, "http://") or
     stringContains(http.request.uri, "https://") or
     stringContains(http.request.uri, "gopher://") or
     stringContains(http.request.uri, "169.254.169.254") or
     stringContains(http.request.uri, "127.0.0.1") or
     stringContains(http.request.uri, "localhost")]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=stream:http
| search uri_path="*/finesse*" (uri_query="*http://*" OR uri_query="*https://*" OR uri_query="*gopher://*" OR uri_query="*169.254.169.254*" OR uri_query="*127.0.0.1*" OR uri_query="*localhost*")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, uri_query, status
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,cve-2026-20362,">
  <rule id="2026203" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>\.*/finesse.*</url>
    <regex>https?://|gopher://|169\.254\.169\.254|127\.0\.0\.1|localhost</regex>
    <description>CVE-2026-20362: Possible Cisco Finesse SSRF attempt detected in HTTP request</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>ssrf,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is listed in the supplied data; the following are standard SSRF-class mitigations pending an official Cisco advisory.

1. Immediate mitigations:

• Restrict network exposure of the Cisco Finesse web-based management interface. Do not expose it directly to the internet; place it behind access control, VPN, or allow-listed source ranges.
• Enforce authentication and segmentation so that only trusted administrative networks can reach the management interface.
• Apply egress filtering on the Finesse host/segment to block server-originated requests to loopback, link-local (169.254.0.0/16), and other internal-only ranges unless explicitly required, limiting SSRF reach.
• Monitor web and proxy logs for crafted requests containing URL-like values (http://, https://, gopher://, internal IPs) targeting Finesse paths.

2. Patch/upgrade steps:

• No patch is currently identified. Monitor Cisco's official security advisory portal for a Finesse advisory tied to CVE-2026-20362, and apply the vendor-supplied fixed release as soon as it is published.
• Until a fix exists, treat exposed interfaces as vulnerable and prioritize compensating controls.

3. Long-term hardening:

• Adopt strict server-side allow-listing for any outbound request destinations derived from user input, with schema and host validation.
• Implement least-privilege network egress for application servers and remove unnecessary outbound reachability.
• Maintain an inventory of externally reachable management interfaces and regularly validate them against vendor advisories.
• Continuously track patch status and re-assess as EPSS scoring and any exploit evidence become available.

References

• NVD — CVE-2026-20362: https://nvd.nist.gov/vuln/detail/CVE-2026-20362
• MITRE CWE-918 — Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Cisco Security Advisories portal (monitor for Finesse advisory referencing CVE-2026-20362): https://sec.cloudapps.cisco.com/security/center/publicationListing.x
• FIRST EPSS (score pending for CVE-2026-20362): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-20362 not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog