Threat reportVulnerabilityTL-2026-4645
Cisco Finesse Unauthenticated Server-Side Request Forgery via Apache Shindig Proxy (CVE-2026-20362)
Cisco Finesse Unauthenticated Server-Side Request Forgery (TL-2026-4645), also tracked as cisco-sa-finesse-ssrf-mmSuyugS, is a high-severity software vulnerability scored CVSS 7.2, first published 2026-10-28. It has no confirmed attribution, affects Cisco Cisco Finesse, references 1 CVE (CVE-2026-20362), maps to 6 MITRE ATT&CK techniques (T1018, T1046, T1082), and is covered by 9 detection rules and 8 indicators of compromise.
- CVSS
- 7.2/10High
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-4645
- Threat ID
- TL-2026-4645
- Also known as
- cisco-sa-finesse-ssrf-mmSuyugS, CSCwv36526
- Severity
- HIGH
- CVSS
- 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)
- Status
- TRACKING
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- enterprise contact centers
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 8
Malware and tooling in Cisco Finesse Unauthenticated Server-Side Request Forgery
Malware and tooling: Horizon3 NodeZero Rapid Response, Systeminfo - S0096
How Cisco Finesse Unauthenticated Server-Side Request Forgery works
An unauthenticated SSRF (CWE-918) in the web-based management interface of Cisco Finesse, Packaged CCE/Unified CCE and Unified CCX lets a remote attacker make the server issue requests to loopback-only and internal services, exposing deployment and infrastructure details. Cisco PSIRT reports no known malicious use, and no fixed releases are available until January-February 2027.
CVE-2026-20362 (CVSS v3.1 7.2, AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) is a server-side request forgery flaw in the web-based management interface of Cisco Finesse, caused by improper input validation for specific HTTP requests. The Cisco advisory (cisco-sa-finesse-ssrf-mmSuyugS, bug ID CSCwv36526) was first published on 2026-10-07 and credits Noah King and Brandon Peterson of Horizon3. The flaw also affects Cisco Packaged Contact Center Enterprise / Unified Contact Center Enterprise and Unified Contact Center Express, which embed Finesse. Cisco Unified Intelligence Center is not affected.
Per Horizon3's analysis, the embedded Apache Shindig content proxy retrieves attacker-supplied URLs and returns the responses to unauthenticated callers. An attacker can use this to reach services bound only to loopback or otherwise internal, for example the Finesse REST API at 127.0.0.1:8082. Responses such as SystemInfo reveal the deployment type, node hostnames and the XMPP domain. This enables infrastructure enumeration and reconnaissance of the contact-center deployment. The changed-scope CVSS vector reflects impact on services associated with the affected device, with limited confidentiality and integrity impact and no availability impact.
Affected: Cisco Finesse 12.6 and earlier and 15.0 (NVD lists 12.6(1) through 15.0(1)SU2 including intermediate ES/SU releases); Packaged CCE/Unified CCE earlier than 15.0 and 15.0; Unified CCX 12.5 and earlier and 15.0. As of 2026-10-27 no fixed releases exist. Planned fixes are Packaged CCE/Unified CCE 15.0(1)ES202701 (January 2027), Finesse 15.0(1) SU3 (February 2027) and Unified CCX 15.0(1) SU2 (February 2027). Cisco states there are no workarounds. Cisco PSIRT reports no known malicious use, the CVE is not in CISA KEV, and no IOCs have been published. Horizon3 released a NodeZero Rapid Response test on 2026-10-27. Details are public, so defenders should restrict network access to the Finesse web interface and monitor for anomalous Finesse-originated requests to loopback and internal services until patches ship.
MITRE ATT&CK techniques used in TL-2026-4645
Discovery
T1018 Remote System Discovery; T1046 Network Service Discovery; T1082 System Information Discovery
Initial Access
T1190 Exploit Public-Facing Application
Reconnaissance
T1590 Gather Victim Network Information; T1592 Gather Victim Host Information
Affected products and versions in Cisco Finesse Unauthenticated Server-Side Request Forgery
- Cisco — Cisco Finesse
Vulnerable versions: 12.6 and earlier; 15.0
Fixed in: 15.0(1) SU3 (planned February 2027) - Cisco — Cisco Packaged Contact Center Enterprise / Unified Contact Center Enterprise
Vulnerable versions: earlier than 15.0; 15.0
Fixed in: 15.0(1)ES202701 (planned January 2027) - Cisco — Cisco Unified Contact Center Express
Vulnerable versions: 12.5 and earlier; 15.0
Fixed in: 15.0(1) SU2 (planned February 2027)
Remediation for Cisco Finesse Unauthenticated Server-Side Request Forgery
Patches
- Packaged CCE/Unified CCE 15.0(1)ES202701 (planned January 2027)
- Cisco Finesse 15.0(1) SU3 (planned February 2027)
- Cisco Unified CCX 15.0(1) SU2 (planned February 2027)
Immediate actions
- Restrict access to the Finesse web interface to trusted networks or authenticated VPN only
- Isolate Finesse, Packaged CCE/Unified CCE and Unified CCX web interfaces from untrusted networks
- Monitor for unexpected Finesse-originated requests to loopback and internal services such as 127.0.0.1:8082
- Monitor outbound traffic from Finesse servers for anomalous requests
Workarounds
- Cisco states there are no workarounds that address this vulnerability
Longer-term hardening
- Track Cisco advisory cisco-sa-finesse-ssrf-mmSuyugS and plan upgrades once fixed releases ship
- Validate exposure and remediation with Horizon3 NodeZero Rapid Response test
CVEs associated with Cisco Finesse Unauthenticated Server-Side Request Forgery
Weaknesses (CWE) in Cisco Finesse Unauthenticated Server-Side Request Forgery
Timeline of Cisco Finesse Unauthenticated Server-Side Request Forgery
- Horizon3.ai published attack research describing the Apache Shindig proxy SSRF reaching internal services such as the Finesse REST API at 127.0.0.1:8082
- NVD record for CVE-2026-20362 created with CVSS v3.1 base score 7.2 and CWE-918
- Cisco published advisory cisco-sa-finesse-ssrf-mmSuyugS (bug ID CSCwv36526) for CVE-2026-20362; credit to Noah King and Brandon Peterson of Horizon3
- No fixed releases available; Cisco PSIRT reports no known malicious use and the CVE is not in CISA KEV
- Horizon3 released a NodeZero Rapid Response test for CVE-2026-20362
- Planned (January 2027): Packaged CCE/Unified CCE 15.0(1)ES202701 fixed release
- Planned (February 2027): Finesse 15.0(1) SU3 and Unified CCX 15.0(1) SU2 fixed releases
Sources cited for Cisco Finesse Unauthenticated Server-Side Request Forgery
- Cisco Security Advisory: Cisco Finesse Server-Side Request Forgery Vulnerability
- Cisco Security Advisory (cisco.com mirror)
- Horizon3.ai - CVE-2026-20362 Cisco Finesse Server-Side Request Forgery Vulnerability
- NVD - CVE-2026-20362
- SecurityOnline - Cisco Finesse Vulnerability CVE-2026-20362
- OpenCVE - CVE-2026-20362
- CWE-918: Server-Side Request Forgery (SSRF)
Detection coverage for TL-2026-4645
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4645 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.