CVE-2026-20117

Summary

A vulnerability in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface.

This vulnerability exists because the web-based management interface of an affected system does not sufficiently validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Affected Software

VendorProductVersion RangeStatus
CiscoCisco Unified Contact Center Express10.5(1)SU1affected
CiscoCisco Unified Contact Center Express10.6(1)affected
CiscoCisco Unified Contact Center Express11.6(1)affected
CiscoCisco Unified Contact Center Express10.6(1)SU1affected
CiscoCisco Unified Contact Center Express10.6(1)SU3affected
CiscoCisco Unified Contact Center Express11.6(2)affected
CiscoCisco Unified Contact Center Express12.0(1)affected
CiscoCisco Unified Contact Center Express11.0(1)SU1affected
CiscoCisco Unified Contact Center Express11.5(1)SU1affected
CiscoCisco Unified Contact Center Express10.5(1)affected
CiscoCisco Unified Contact Center Express12.5(1)affected
CiscoCisco Unified Contact Center Express12.5(1)SU1affected
CiscoCisco Unified Contact Center Express12.5(1)SU2affected
CiscoCisco Unified Contact Center Express12.5(1)SU3affected
CiscoCisco Unified Contact Center Express12.5(1)_SU03_ES01affected
CiscoCisco Unified Contact Center Express12.5(1)_SU03_ES02affected
CiscoCisco Unified Contact Center Express12.5(1)_SU02_ES03affected
CiscoCisco Unified Contact Center Express12.5(1)_SU02_ES04affected
CiscoCisco Unified Contact Center Express12.5(1)_SU02_ES02affected
CiscoCisco Unified Contact Center Express12.5(1)_SU01_ES02affected
CiscoCisco Unified Contact Center Express12.5(1)_SU01_ES03affected
CiscoCisco Unified Contact Center Express12.5(1)_SU02_ES01affected
CiscoCisco Unified Contact Center Express11.6(2)ES07affected
CiscoCisco Unified Contact Center Express11.6(2)ES08affected
CiscoCisco Unified Contact Center Express12.5(1)_SU01_ES01affected
CiscoCisco Unified Contact Center Express12.0(1)ES04affected
CiscoCisco Unified Contact Center Express12.5(1)ES02affected
CiscoCisco Unified Contact Center Express12.5(1)ES03affected
CiscoCisco Unified Contact Center Express11.6(2)ES06affected
CiscoCisco Unified Contact Center Express12.5(1)ES01affected
CiscoCisco Unified Contact Center Express12.0(1)ES03affected
CiscoCisco Unified Contact Center Express12.0(1)ES01affected
CiscoCisco Unified Contact Center Express11.6(2)ES05affected
CiscoCisco Unified Contact Center Express12.0(1)ES02affected
CiscoCisco Unified Contact Center Express11.6(2)ES04affected
CiscoCisco Unified Contact Center Express11.6(2)ES03affected
CiscoCisco Unified Contact Center Express11.6(2)ES02affected
CiscoCisco Unified Contact Center Express11.6(2)ES01affected
CiscoCisco Unified Contact Center Express10.6(1)SU3ES03affected
CiscoCisco Unified Contact Center Express11.0(1)SU1ES03affected
CiscoCisco Unified Contact Center Express10.6(1)SU3ES01affected
CiscoCisco Unified Contact Center Express10.5(1)SU1ES10affected
CiscoCisco Unified Contact Center Express11.5(1)SU1ES03affected
CiscoCisco Unified Contact Center Express11.6(1)ES02affected
CiscoCisco Unified Contact Center Express11.5(1)ES01affected
CiscoCisco Unified Contact Center Express10.6(1)SU2affected
CiscoCisco Unified Contact Center Express10.6(1)SU2ES04affected
CiscoCisco Unified Contact Center Express11.6(1)ES01affected
CiscoCisco Unified Contact Center Express10.6(1)SU3ES02affected
CiscoCisco Unified Contact Center Express11.5(1)SU1ES02affected
CiscoCisco Unified Contact Center Express11.5(1)SU1ES01affected
CiscoCisco Unified Contact Center Express11.0(1)SU1ES02affected
CiscoCisco Unified Contact Center Express12.5(1)_SU03_ES03affected
CiscoCisco Unified Contact Center Express12.5(1)_SU03_ES04affected
CiscoCisco Unified Contact Center Express12.5(1)_SU03_ES05affected
CiscoCisco Unified Contact Center ExpressUCCX 15.0.1affected
CiscoCisco Unified Contact Center Express12.5(1)_SU03_ES06affected
CiscoCisco Unified Contact Center Express12.5(1)_SU03_ES07affected
CiscoCisco Unified Contact Center Express15.0(1)affected
CiscoCisco Unified Contact Center Express15.0(1)ES01affected
CiscoCisco Unified Contact Center Express15.0(1)ES-MSOauthaffected
CiscoCisco Unified Contact Center Express1501_ES01_CSCws06843affected

Weaknesses

  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References