# Cisco Finesse Unauthenticated Server-Side Request Forgery via Apache Shindig Proxy (CVE-2026-20362)

> An unauthenticated SSRF (CWE-918) in the web-based management interface of Cisco Finesse, Packaged CCE/Unified CCE and Unified CCX lets a remote attacker make the server issue requests to loopback-only and internal services, exposing deployment and infrastructure details. Cisco PSIRT reports no known malicious use, and no fixed releases are available until January-February 2027.

- **Published:** 2026-10-28T13:43:32Z
- **Last reviewed:** 2026-10-28T13:43:32Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4645
- **ID:** TL-2026-4645
- **Severity:** HIGH (CVSS 7.2)
- **Category:** VULNERABILITY
- **Status:** TRACKING
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-20362

## Description

CVE-2026-20362 (CVSS v3.1 7.2, AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) is a server-side request forgery flaw in the web-based management interface of Cisco Finesse, caused by improper input validation for specific HTTP requests. The Cisco advisory (cisco-sa-finesse-ssrf-mmSuyugS, bug ID CSCwv36526) was first published on 2026-10-07 and credits Noah King and Brandon Peterson of Horizon3. The flaw also affects Cisco Packaged Contact Center Enterprise / Unified Contact Center Enterprise and Unified Contact Center Express, which embed Finesse. Cisco Unified Intelligence Center is not affected.

Per Horizon3's analysis, the embedded Apache Shindig content proxy retrieves attacker-supplied URLs and returns the responses to unauthenticated callers. An attacker can use this to reach services bound only to loopback or otherwise internal, for example the Finesse REST API at 127.0.0.1:8082. Responses such as SystemInfo reveal the deployment type, node hostnames and the XMPP domain. This enables infrastructure enumeration and reconnaissance of the contact-center deployment. The changed-scope CVSS vector reflects impact on services associated with the affected device, with limited confidentiality and integrity impact and no availability impact.

Affected: Cisco Finesse 12.6 and earlier and 15.0 (NVD lists 12.6(1) through 15.0(1)SU2 including intermediate ES/SU releases); Packaged CCE/Unified CCE earlier than 15.0 and 15.0; Unified CCX 12.5 and earlier and 15.0. As of 2026-10-27 no fixed releases exist. Planned fixes are Packaged CCE/Unified CCE 15.0(1)ES202701 (January 2027), Finesse 15.0(1) SU3 (February 2027) and Unified CCX 15.0(1) SU2 (February 2027). Cisco states there are no workarounds. Cisco PSIRT reports no known malicious use, the CVE is not in CISA KEV, and no IOCs have been published. Horizon3 released a NodeZero Rapid Response test on 2026-10-27. Details are public, so defenders should restrict network access to the Finesse web interface and monitor for anomalous Finesse-originated requests to loopback and internal services until patches ship.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1046 Network Service Discovery
- T1082 System Information Discovery
- T1018 Remote System Discovery
- T1590 Gather Victim Network Information
- T1592 Gather Victim Host Information

## Sources

- [Cisco Security Advisory: Cisco Finesse Server-Side Request Forgery Vulnerability](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-ssrf-mmSuyugS)
- [Cisco Security Advisory (cisco.com mirror)](https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-finesse-ssrf-mmSuyugS.html)
- [Horizon3.ai - CVE-2026-20362 Cisco Finesse Server-Side Request Forgery Vulnerability](https://horizon3.ai/attack-research/vulnerabilities/cve-2026-20362/)
- [NVD - CVE-2026-20362](https://nvd.nist.gov/vuln/detail/CVE-2026-20362)
- [SecurityOnline - Cisco Finesse Vulnerability CVE-2026-20362](https://securityonline.info/cisco-finesse-vulnerability-cve-2026-20362/)
- [OpenCVE - CVE-2026-20362](https://app.opencve.io/cve/CVE-2026-20362)
- [CWE-918: Server-Side Request Forgery (SSRF)](https://cwe.mitre.org/data/definitions/918.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4645