{"schema":"threatline.record/2","record":{"id":"CVE-2026-20362","aliases":[],"summary":"Cisco Finesse Server-Side Request Forgery Vulnerability","details":"A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device.\r\n\r\nThis vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain limited sensitive information for services that are associated with the affected device.","categories":["Network & edge"],"product":"Cisco Finesse","vendor":"Cisco","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-20362","source_modified_at":"2026-10-07T19:23:47.049Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"Cisco Finesse","vendor":"Cisco","versions":[{"version":"12.6(1)","status":"affected"},{"version":"12.6(1)ES1","status":"affected"},{"version":"12.6(1)ES2","status":"affected"},{"version":"12.6(1)ES3","status":"affected"},{"version":"12.6(1)ES4","status":"affected"},{"version":"12.6(1)ES5","status":"affected"},{"version":"12.6(1)ES6","status":"affected"},{"version":"12.6(1)ES7","status":"affected"},{"version":"12.6(1)ES7_ET","status":"affected"},{"version":"12.6(2)","status":"affected"},{"version":"12.6(1)ES8","status":"affected"},{"version":"12.6(1)ES9","status":"affected"},{"version":"12.6(2)ES1","status":"affected"},{"version":"12.6(1)ES10","status":"affected"},{"version":"12.6(1)ES11","status":"affected"},{"version":"12.6(2)ES2","status":"affected"},{"version":"12.6(2)ES3","status":"affected"},{"version":"12.6(2)ES4","status":"affected"},{"version":"12.6(2)ES5","status":"affected"},{"version":"15.0(1)","status":"affected"},{"version":"12.6(2)ES6","status":"affected"},{"version":"15.0(1)ES202508","status":"affected"},{"version":"15.0(1)ES202511","status":"affected"},{"version":"15.0(1)ES202602","status":"affected"},{"version":"15.0(1)SU1","status":"affected"},{"version":"12.6(2)ES7","status":"affected"},{"version":"15.0(1)SU2","status":"affected"},{"version":"12.6(2)ES8","status":"affected"}],"defaultStatus":"unknown"}],"fixed_versions":[],"cvss":7.2,"severity":"High","kev":{"listed":false},"epss":{"probability":0.0047,"percentile":0.39757,"score_date":"2026-10-23"},"published_at":"2026-10-07T16:12:12.584Z","modified_at":"2026-10-07T19:23:47.049Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-20362","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-07T19:23:47.049Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-20362","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-ssrf-mmSuyugS"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-07T19:11:45.795003Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-07T19:23:47.049Z","content_hash":"78a4c0e977ce08811664066ba5134846e30e265f2f717cdc79aa30608f940794"}}