Cisco Finesse Server-Side Request Forgery Vulnerability

CVE-2026-20362 is a high-severity server-side request forgery (SSRF) vulnerability in Cisco Finesse’s web-based management interface. An unauthenticated remote attacker can send crafted HTTP requests through an affected server to obtain limited sensitive information from associated services. The vulnerability has a CVSS v3.1 score of 7.2 (High). 

Discovered by Horizon3 researchers Noah King and Brandon Peterson, the vulnerability affects Finesse regardless of configuration. Cisco PSIRT reports no known malicious use. As of October 27, 2026, fixes remain scheduled for January and February 2027. 

Technical Details

The flaw stems from improper input validation in the Finesse web interface. An attacker needs network access to the affected interface, but exploitation requires neither authentication nor user interaction. 

Horizon3’s technical findings identify the embedded Apache Shindig content proxy as the affected component. The proxy retrieves an attacker-supplied URL from the server and returns the response to the unauthenticated caller.

An attacker can direct these requests to loopback-only or internal network services. For example, the Finesse REST API at 127.0.0.1:8082 exposes a SystemInfo response containing the deployment type, primary and secondary node hostnames, and XMPP domain. This enables infrastructure enumeration and access to responses from services that are not directly reachable externally. 

• Vulnerability class: CWE-918, Server-Side Request Forgery.
• Authentication required: None.
• User interaction required: None.
• CVSS v3.1: 7.2 (High).
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. 

Stop Guessing, Start Proving

NodeZero® Proactive Security Platform Rapid Response

A NodeZero Rapid Response test has been developed to safely validate whether this vulnerability can be exploited in your environment. The test executes real attack techniques without causing damage, giving teams immediate clarity on exposure.

• Run the Rapid Response test: Launch from NodeZero to determine whether exploitation is possible.
• Reduce exposure now and patch when available: Restrict access to trusted networks or authenticated VPN connections while awaiting Cisco’s fixed releases. Apply the appropriate update when released.
• Re-run the test: Assess the effectiveness of access restrictions from the relevant network locations, then verify that the vulnerability is no longer exploitable after patching.

Affected Versions & Patch

Affected

Cisco Unified Intelligence Center is not affected. 

Fixed

No fixed release is available as of October 27, 2026. Cisco lists the following planned releases:

Older branches require migration to a fixed release. Upgrading to an affected 15.0 release does not resolve the vulnerability. Review Cisco’s advisory for updated availability. 

Mitigations

Cisco lists no workaround that addresses the vulnerability. 

While awaiting patches, reduce exposure by restricting the Finesse web interface to trusted networks or authenticated VPN connections. Monitor for unexpected requests from Finesse servers to internal services. These measures reduce opportunities for exploitation; they do not correct the underlying flaw.

Timeline

• October 7, 2026: Cisco published its advisory, credited Horizon3’s researchers, and announced planned fixed releases.
• October 7, 2026: NVD published the vulnerability record. 
• October 27, 2026: Horizon3 released the NodeZero Rapid Response test for CVE-2026-20362.

References

• Cisco Security Advisory: Cisco Finesse Server-Side Request Forgery Vulnerability
• CVE-2026-20362 NVD record
• CWE-918: Server-Side Request Forgery (SSRF)
• SecurityOnline: Cisco Finesse CVE-2026-20362