CVE-2026-20116 is a cross-site scripting (XSS) vulnerability found in the web-based management interfaces of Cisco Finesse, Packaged CCE, Unified CCE, Unified CCX, and Unified Intelligence Center. This medium-severity flaw (CVSS 6.1) stems from insufficient input validation, allowing an unauthenticated, remote attacker to inject malicious code. A successful exploit could lead to arbitrary script execution in the user's browser context or access sensitive browser-based information, requiring user interaction. Currently, there is no public exploit code available, it is not listed in CISA's KEV catalog, and community discussion remains minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Cisco | Cisco Unified Contact Center Express | 10.5(1), 10.5(1)SU1, 10.5(1)SU1ES10, 10.6(1), 10.6(1)SU1, 10.6(1)SU2, 10.6(1)SU2ES04, 10.6(1)SU3, 10.6(1)SU3ES01, 10.6(1)SU3ES02, 10.6(1)SU3ES03, 11.0(1)SU1, 11.0(1)SU1ES02, 11.0(1)SU1ES03, 11.5(1)ES01, 11.5(1)SU1, 11.5(1)SU1ES01, 11.5(1)SU1ES02, 11.5(1)SU1ES03, 11.6(1), 11.6(1)ES01, 11.6(1)ES02, 11.6(2), 11.6(2)ES01, 11.6(2)ES02, 11.6(2)ES03, 11.6(2)ES04, 11.6(2)ES05, 11.6(2)ES06, 11.6(2)ES07, 11.6(2)ES08, 12.0(1), 12.0(1)ES01, 12.0(1)ES02, 12.0(1)ES03, 12.0(1)ES04, 12.5(1), 12.5(1)ES01, 12.5(1)ES02, 12.5(1)ES03, 12.5(1)SU1, 12.5(1)SU2, 12.5(1)SU3, 12.5(1)_SU01_ES01, 12.5(1)_SU01_ES02, 12.5(1)_SU01_ES03, 12.5(1)_SU02_ES01, 12.5(1)_SU02_ES02, 12.5(1)_SU02_ES03, 12.5(1)_SU02_ES04, 12.5(1)_SU03_ES01, 12.5(1)_SU03_ES02, 12.5(1)_SU03_ES03, 12.5(1)_SU03_ES04, 12.5(1)_SU03_ES05, 12.5(1)_SU03_ES06, 12.5(1)_SU03_ES07, 15.0(1), 15.0(1)ES-MSOauth, 15.0(1)ES01, 1501_ES01_CSCws06843, UCCX 15.0.1CNA affecteddefault unknown |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Multiple Cisco Contact Center Products Cross-Site Scripting Vulnerabilities
Mar 11, 2026Multiple Cisco Contact Center Products Cross-Site Scripting Vulnerabilities
Mar 11, 2026Multiple Cisco Contact Center Products Cross-Site Scripting Vulnerabilities
Mar 11, 2026Multiple Cisco Contact Center Products Cross-Site Scripting Vulnerabilities
Mar 11, 2026Multiple Cisco Contact Center Products Cross-Site Scripting Vulnerabilities
Mar 11, 2026