Cisco Finesse CVE-2026-20362

Exploitation requires network access to the Cisco Finesse web-based management interface, which must be reachable by the attacker; the flaw is improper input validation of specific HTTP requests, so sending a single crafted HTTP request to that interface suffices with no authentication, no privileges, and no user interaction (AV:N/AC:L/PR:N/UI:N against default configurations). The practical limiting factors are: (1) the management interface is frequently segmented on internal/management networks rather than internet-exposed, constraining who can reach it; and (2) impact is bounded to 'limited sensitive information' from services associated with the device, not full data access or control. No special non-default feature or configuration mode is named as a prerequisite in the description.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, which normally signals high priority; however, the impact metrics are deliberately modest (C:L/I:L/A:N) and the vendor-assigned 7.2 score is driven largely by the scope change (S:C) rather than by severe direct impact. This is an SSRF (CWE-918) that, per Cisco's own description, yields only 'limited sensitive information' - not code execution, full data disclosure, or service disruption. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is currently no evidence of active exploitation or weaponization; exploitation status is 'no public exploit identified at time of analysis.' Net assessment: a genuine but moderate-priority issue - the unauthenticated network reachability warrants patching, but the limited confidentiality/integrity impact and absence of exploitation signals place it below critical RCE-class bugs. Note the Cisco-assigned I:L is not substantiated by the description text, which mentions only information disclosure (confidentiality); verify the integrity claim with the vendor advisory.

An attacker with network reachability to the Cisco Finesse web-based management interface sends a crafted HTTP request that the server fails to validate, coercing the server into making attacker-influenced requests to internal/associated back-end services. The attacker uses the resulting SSRF to retrieve limited sensitive information from services the Finesse host can reach. No authentication or user interaction is required (PR:N/UI:N), but no public exploit code is identified at time of analysis.