CVE-2026-20117 identifies a cross-site scripting (XSS) vulnerability within the web-based management interface of Cisco Unified Contact Center Express (Unified CCX), caused by insufficient validation of user-supplied input. This medium-severity vulnerability (CVSS 6.1) allows an unauthenticated, remote attacker to inject malicious code, potentially executing arbitrary scripts or accessing sensitive browser information, though it requires user interaction for successful exploitation. Currently, there is no evidence of active exploitation, no public exploit code available, and community discussion or media coverage remains minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 15.0\(1\)ES01CPE matchmatch criteria | cpe:2.3:a:cisco:unified_contact_center_express:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Multiple Cisco Contact Center Products Cross-Site Scripting Vulnerabilities
Mar 11, 2026Multiple Cisco Contact Center Products Cross-Site Scripting Vulnerabilities
Mar 11, 2026Multiple Cisco Contact Center Products Cross-Site Scripting Vulnerabilities
Mar 11, 2026Multiple Cisco Contact Center Products Cross-Site Scripting Vulnerabilities
Mar 11, 2026Multiple Cisco Contact Center Products Cross-Site Scripting Vulnerabilities
Mar 11, 2026