Closing a contact-center security ticket requires checking the bundled component, as well as the platform release.
Changed October 29, 2026 at 21:22 GMT: Cisco revised CVE-2026-20362 / cisco-sa-finesse-ssrf-mmSuyugS / CSCwv36526 to v1.1. It changed Finesse and Unified CCX fix tables and replaced Packaged CCE/Unified CCE platform tables with instructions to upgrade the Finesse component. Original publication remains October 7, 2026.
Applicability and remediation targets
Cisco rates this High, CVSS 3.1 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). An unauthenticated crafted request to the management interface can cause SSRF and expose limited information from associated services. Finesse is affected regardless of configuration; bundled Packaged CCE, Unified CCE and Unified CCX require review. Unified Intelligence Center is not affected by this issue.
| Deployment | Cisco revised first-fixed guidance |
|---|---|
| Finesse 15.0 | 15.0(1) SU2 ES1 |
| Finesse 12.6 and earlier | Migrate to a fixed release |
| Unified CCX 15.0 | 15.0(1) SU1 |
| Unified CCX 12.5 and earlier | Migrate to a fixed release |
| Packaged CCE / Unified CCE | Upgrade the Finesse component |
The advisory does not give complete lower affected bounds. Its summary still says Cisco plans updates while the fixed table supplies these targets; confirm media availability and the supported product combination before scheduling. No complete workaround is listed. Cisco knows of a public announcement but reports no known malicious use. This CVE is absent from the checked 1,764-record CISA KEV catalog; no federal KEV deadline applies to this finding.
Suggested MSP priority: high where applicable
Inventory → containment: identify the actual Finesse version, deployment role, bundled contact-center products and management reachability. Check every relevant node. Restrict unnecessary management access with tested controls that preserve agent, supervisor, API and recovery workflows; this is an MSP precaution, not a verified CVE workaround.
Upgrade → verify: use the revised component-specific target and Cisco-supported upgrade/migration path. Validate compatibility and a recovery plan, then confirm the running Finesse/CCX build on all applicable nodes. Test agent/supervisor sign-in, integrations, reporting and call flows. A CCE platform version alone is insufficient closure evidence. Investigate suspicious access through the normal authorized response process; no CVE-specific blanket credential rotation or mandatory forensic procedure was verified.
Official sources
Cisco PSIRT advisory and revision history · Cisco-authored CNA record · Official CISA KEV catalog
Last verified: October 29, 2026. Check applicability per environment; no customer deployment or compromise is assumed.