CVE-2026-20314

Summary

A vulnerability in Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified Contact Center Enterprise (Unified CCE) could allow an authenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device.

This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to send arbitrary network requests that are sourced from the affected device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device. 

Affected Software

VendorProductVersion RangeStatus
CiscoCisco Packaged Contact Center Enterprise12.5(1)affected
CiscoCisco Packaged Contact Center Enterprise11.0(1)affected
CiscoCisco Packaged Contact Center Enterprise12.0(1)affected
CiscoCisco Packaged Contact Center Enterprise11.0(2)affected
CiscoCisco Packaged Contact Center Enterprise11.5(1)affected
CiscoCisco Packaged Contact Center Enterprise10.5(1)affected
CiscoCisco Packaged Contact Center Enterprise10.5(2)affected
CiscoCisco Packaged Contact Center Enterprise11.6(2)affected
CiscoCisco Packaged Contact Center Enterprise10.5(1)_ES7affected
CiscoCisco Packaged Contact Center Enterprise11.6(1)affected
CiscoCisco Packaged Contact Center Enterprise10.5(2)_ES8affected
CiscoCisco Packaged Contact Center Enterprise12.5(2)affected
CiscoCisco Packaged Contact Center Enterprise12.6(2)affected
CiscoCisco Packaged Contact Center Enterprise15.0(1)affected
CiscoCisco Unified Contact Center Enterprise12.6(1)ES3affected
CiscoCisco Unified Contact Center Enterprise12.6(1)ES1affected
CiscoCisco Unified Contact Center Enterprise12.6(1)affected
CiscoCisco Unified Contact Center Enterprise12.6(1)ES2affected
CiscoCisco Unified Contact Center Enterprise12.6(1)SecurityPatchaffected
CiscoCisco Unified Contact Center Enterprise12.5(1)ES1affected
CiscoCisco Unified Contact Center Enterprise12.5(1)affected
CiscoCisco Unified Contact Center Enterprise12.6(1)ES4affected
CiscoCisco Unified Contact Center Enterprise11.0(1)affected
CiscoCisco Unified Contact Center Enterprise10.5(1)affected
CiscoCisco Unified Contact Center Enterprise12.0(1)affected
CiscoCisco Unified Contact Center Enterprise10.5affected
CiscoCisco Unified Contact Center Enterprise11.0affected
CiscoCisco Unified Contact Center Enterprise11.5affected
CiscoCisco Unified Contact Center Enterprise12.6(2)affected
CiscoCisco Unified Contact Center Enterprise12.6(2)ES1affected
CiscoCisco Unified Contact Center Enterprise12.6(2)ES2affected
CiscoCisco Unified Contact Center Enterprise15.0(1)affected
CiscoCisco Unified Contact Center Enterprise12.6(2)ES3affected
CiscoCisco Unified Contact Center Enterprise15.0(1)ET01affected
CiscoCisco Unified Contact Center Enterprise15.0(1)_SP1affected
CiscoCisco Unified Contact Center Enterprise15.0(1)ES202508affected
CiscoCisco Unified Contact Center Enterprise15.0(1)ES202511affected
CiscoCisco Unified Contact Center Enterprise12.6(2)ES4affected
CiscoCisco Unified Contact Center Enterprise15.0(1)SU1affected
CiscoCisco Unified Contact Center Enterprise15.0(1)ES202603affected
CiscoCisco Unified Contact Center Enterprise12.6(2)ES5affected

Weaknesses

  • CWE-918: Server-Side Request Forgery (SSRF)

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References