CVE-2026-20314: Cisco Packaged Contact Center Enterprise & Cisco Unified Contact Center Ent

Description

A vulnerability in Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified Contact Center Enterprise (Unified CCE) could allow an authenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to send arbitrary network requests that are sourced from the affected device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device. 

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Cisco Cisco Packaged Contact Center Enterprise

Default version status: unknown

12.5(1)affected
11.0(1)affected
12.0(1)affected
11.0(2)affected
11.5(1)affected
10.5(1)affected
10.5(2)affected
11.6(2)affected
10.5(1)_ES7affected
11.6(1)affected
10.5(2)_ES8affected
12.5(2)affected
12.6(2)affected
15.0(1)affected

Cisco Cisco Unified Contact Center Enterprise

Default version status: unknown

12.6(1)ES3affected
12.6(1)ES1affected
12.6(1)affected
12.6(1)ES2affected
12.6(1)SecurityPatchaffected
12.5(1)ES1affected
12.5(1)affected
12.6(1)ES4affected
11.0(1)affected
10.5(1)affected
12.0(1)affected
10.5affected
11.0affected
11.5affected
12.6(2)affected
12.6(2)ES1affected
12.6(2)ES2affected
15.0(1)affected
12.6(2)ES3affected
15.0(1)ET01affected
15.0(1)_SP1affected
15.0(1)ES202508affected
15.0(1)ES202511affected
12.6(2)ES4affected
15.0(1)SU1affected
15.0(1)ES202603affected
12.6(2)ES5affected

References

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucce-pcce-ssrf-TghHxD ↗