Cisco Finesse unauthenticated SSRF vulnerability (CVE-2026-20362) allows limited information disclosure

Baseado só no resumo do feed. O site da fonte não liberou o texto completo para o Tifon, então esta análise saiu apenas do resumo publicado no feed e pode estar incompleta. Ela é atualizada quando outra fonte cobrir o assunto. Ler na fonte original ↗

Linha do tempo

1. sec.cloudapps.cisco.com ↗ · pub. 07/10/2026 13:00 · coletado 19/10 18:01 primeiro registro só resumo do feed

   Cisco Finesse unauthenticated SSRF vulnerability (CVE-2026-20362) allows limited information disclosure

   ler a análise desta fonte ocultar

   Cisco disclosed CVE-2026-20362, a server-side request forgery (SSRF) vulnerability in the web-based management interface of Cisco Finesse. An unauthenticated, remote attacker could exploit it by sending a crafted HTTP request to an affected device. Successful exploitation could expose limited sensitive information from services associated with the device. Cisco rates the Security Impact as High, has not yet released fixes but plans to, and states there are no workarounds. The article does not mention active exploitation.

   Technical Details

   • The flaw stems from improper input validation of specific HTTP requests in the web management interface.
   • It requires no authentication and is exploitable remotely.
   • Impact is limited to information disclosure from services associated with the affected device.
   • The article does not list affected versions.

   Remediation

   • Cisco plans to release software updates; monitor the Cisco advisory cisco-sa-finesse-ssrf-mmSuyugS for fixed releases.
   • No workarounds exist. Until patches are available, restrict network access to the Finesse management interface.