Cisco Contact Center SSRF Vulnerability (CVE‑2026‑20314) Requires Authenticated Access

Cisco’s Packaged Contact Center Enterprise (Packaged CCE) and Unified Contact Center Enterprise (Unified CCE) are now affected by a server‑side request forgery (SSRF) vulnerability, identified as CVE‑2026‑20314. The flaw is triggered when an authenticated user sends a specially crafted HTTP request to the CCE instance. Because the input is not properly validated, the device will forward the request to any network host, effectively acting as a proxy for the attacker.

What an attacker can do

• Probe internal network services that are normally inaccessible from the outside.
• Collect sensitive data or credentials from other systems on the same LAN.
• Use the compromised device as a stepping stone for lateral movement.
• Potentially exfiltrate data to an external destination.

Impact level

The security impact is rated as Medium. While the vulnerability requires valid user credentials, the ability to send arbitrary requests can lead to significant internal exposure if the attacker has sufficient privileges.

Mitigation

• Apply the official Cisco patch released in the latest software update.
• No temporary workarounds exist; the only defense is to update the firmware or software.
• Verify that the patch is applied to all CCE instances in the environment.

"Cisco strongly recommends that all affected installations receive the update immediately to eliminate the SSRF risk."

Next steps for administrators

• Check the current CCE version against the Cisco Security Advisory.
• Schedule a maintenance window to deploy the patch.
• Review user access controls to limit the number of accounts that can authenticate to CCE.
• Monitor logs for unusual outbound traffic originating from CCE devices.