CVE-2026-20055 describes multiple cross‑site scripting weaknesses in the web‑based management interface of Cisco Packaged Contact Center Enterprise and Cisco Unified Contact Center Enterprise. An attacker who has authenticated administrative credentials can inject malicious content into selected pages of the interface. If successful, the injected code executes in the victim’s browser session, potentially allowing the attacker to run arbitrary scripts or read sensitive, browser‑specific data held by the user. The impact is confined to the context of the web interface and depends on the privileges of the abused account.

Affected systems are Cisco’s Packaged Contact Center Enterprise and Cisco Unified Contact Center Enterprise. The advisory does not list specific affected versions, so any installation of these products that is not at the latest maintenance level may be at risk.

The CVSS score of 4.8 suggests moderate risk, while the EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not part of the KEV catalog. An attacker must possess valid administrative credentials, implying that only users with elevated rights can exploit the flaw. Exploitation would allow script execution within the authenticated session and could facilitate data disclosure or session hijack if the attacker succeeds.