CVE-2026-20314
Received Received - Intake

Server-Side Request Forgery in Cisco Packaged CCE and Unified CCE

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: Cisco Systems, Inc.

Description
A vulnerability in Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified Contact Center Enterprise (Unified CCE) could allow an authenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to send arbitrary network requests that are sourced from the affected device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device. 

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-20314
EUVD
EUVD-2026-62573

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
cisco packaged_contact_center_enterprise 15.0(1)es202607
cisco unified_contact_center_enterprise 15.0(1)es202607

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a server-side request forgery (SSRF) vulnerability in Cisco Packaged Contact Center Enterprise and Cisco Unified Contact Center Enterprise. It occurs due to improper input validation for specific HTTP requests. An authenticated remote attacker with valid credentials can send crafted HTTP requests to the device, potentially allowing them to send arbitrary network requests originating from the affected device.

Detection Guidance

To detect this SSRF vulnerability in Cisco Packaged CCE or Unified CCE, monitor for unusual outbound network requests originating from these systems. Check HTTP logs for crafted requests with unexpected parameters or destinations. Inspect network traffic for connections to internal or external systems not initiated by legitimate users.

Impact Analysis

An attacker could exploit this to send arbitrary network requests from your affected device, potentially accessing internal systems or sensitive data. However, the attacker must already have valid user credentials on the device to exploit this vulnerability.

Compliance Impact

This SSRF vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized network requests from affected systems. Exploitation might lead to data exfiltration or unauthorized access to sensitive customer information, which violates GDPR's data protection requirements and HIPAA's safeguards for protected health information.

Mitigation Strategies

Upgrade to fixed software releases such as version 15.0(1)ES202607 or later to fully remediate the issue. No workarounds are available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-20314. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart