HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-20362 — A vulnerability in the web-based management interface of Cisco Finesse could all...

·Source: NIST NVD

Updated:

Executive Summary

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successfu

Analysis

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain limited sensitive information for services that are associated with the affected device. CVSS Score: 7.2. Published: 2026-10-07T17:16:55.303.

Indicators of Compromise (1)

CVE (1)
CVE-2026-20362
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 7, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerability

PHP Announces Critical Security Release for Two Vulnerabilities

On October 20, 2026, the PHP security team announced an upcoming security release addressing two critical vulnerabilities, each rated CVSS v4.0 9.2. The release is scheduled for October 21, 2026, at 14:00 UTC. PHP has indicated that the updates may be released earlier if vulnerability details become public or evidence of active exploitation emerges. Public […]

Qualys Blog
MEDIUMVulnerability

Stolen UpdraftCentral keys used to backdoor WordPress sites

A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites. [...]

BleepingComputer
MEDIUMVulnerability

Mozilla, Google, Apple block compromised eMudhra CA certificates

Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted certificates for legitimate websites. [...]

BleepingComputer