Cisco Finesse SSRF Flaw CVE-2026-20362 Publicly Disclosed, With Fixes Not Due Until 2027

Cisco disclosed CVE-2026-20362, an unauthenticated SSRF in Cisco Finesse (CVSS 7.2) that can cause the server to make attacker-controlled requests and potentially expose limited sensitive information beyond the device. Details are publicly available while patches for affected releases (notably 12.6.x and 15.0 lines) will not ship until Jan–Feb 2027; Cisco reports no observed exploitation. Interim mitigations include keeping the Finesse web interface off untrusted networks and monitoring outbound traffic until fixes are applied.