Cisco Contact Center Enterprise CVE-2026-20314

Exploitation requires the attacker to possess valid user credentials on the affected Cisco Packaged CCE or Unified CCE device (CVSS PR:L confirms low-privilege authentication is sufficient - no administrator rights needed). The attacker must be able to send HTTP requests to the affected platform over the network (AV:N, no local access required). The vulnerability is triggered by specific crafted HTTP requests targeting particular endpoints with improperly validated input parameters; the advisory does not indicate a non-default configuration is required, suggesting the affected code path is reachable in standard deployments. Exploitation is constrained by the authentication requirement - unauthenticated external attackers cannot exploit this without first obtaining credentials through a separate means. No user interaction is required once credentials are obtained (UI:N). The scope is also limited to what the CCE server can reach from its network position.

The CVSS 5.0 base score reflects a moderate but meaningful risk profile: network-accessible (AV:N), low complexity (AC:L), requiring only low-privilege credentials (PR:L), with a scope change (S:C) confirming cross-boundary impact potential. The limited impact metrics (C:N/I:L/A:N) suppress the score, though SSRF vulnerabilities in enterprise platforms often carry implicit confidentiality risk if server responses are returned to the attacker - a detail the vendor advisory does not fully clarify. No EPSS data was provided, and no KEV listing exists, suggesting exploitation is not currently widespread. The authentication barrier (PR:L) meaningfully limits opportunistic exploitation - attackers must already hold valid credentials. That said, insider threats or compromised user accounts represent a realistic path, and even a mid-sized municipal IT team in swidnica running Cisco Unified CCE across a large version footprint should treat patching as a standard maintenance priority given the broad affected version range spanning over a decade of releases. The lack of a POC and KEV listing keeps this below emergency threshold, but the scope change and internal network pivot potential warrant timely remediation.

An attacker with valid low-privilege credentials on the Cisco CCE platform submits a crafted HTTP request containing a manipulated URL or host parameter to a vulnerable endpoint. The server fails to validate the input and issues an outbound request to an attacker-specified target - such as an internal CRM API, a metadata service endpoint, or an internal routing infrastructure component - effectively using the CCE platform as a proxy to access resources the attacker cannot reach directly. No public proof-of-concept exploit code has been identified at time of analysis, though the well-understood nature of SSRF means a functional exploit can be constructed from the advisory description alone by a skilled attacker.