CVE-2026-20362 | Cisco Finesse Server-Side Request Forgery Vulnerability

A high-severity SSRF vulnerability in Cisco Finesse's web management interface allows unauthenticated attackers to send crafted HTTP requests that trick the server into querying internal services, potentially exposing sensitive data from backend systems. The critical issue is compounded by the absence of an available patch, with remediation not expected until January–February 2027 — leaving organizations in a prolonged exposure window of several months. SSRF vulnerabilities are particularly dangerous in contact center environments like Finesse, which often have privileged access to internal APIs, databases, and customer data. This incident underscores the importance of compensating controls when vendor patches are unavailable, and the need for proactive vulnerability tracking and network-level mitigations.