These vulnerabilities exist because the web-based management interface does not properly validate user-supplied input. An attacker could exploit these vulnerabilities by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit these vulnerabilities, the attacker must have valid administrative credentials.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Cisco | Cisco Packaged Contact Center Enterprise | unknown |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Cisco | Cisco Unified Contact Center Enterprise | unknown |
|
No data.
No data.
| Vendor | Product | Confidence | Versions |
|---|---|---|---|
| Cisco | Packaged Contact Center Enterprise | — | — |
| Cisco | Unified Contact Center Enterprise | — | — |
Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .
No remediation available yet.
Tracking
Sign in to view the affected projects.
No advisories yet.
Fri, 23 Jan 2026 16:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Cisco
Cisco packaged Contact Center Enterprise Cisco unified Contact Center Enterprise |
|
| Vendors & Products |
Cisco
Cisco packaged Contact Center Enterprise Cisco unified Contact Center Enterprise |
Wed, 21 Jan 2026 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Wed, 21 Jan 2026 16:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Multiple vulnerabilities in the web-based management interface of Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified Contact Center Enterprise (Unified CCE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. These vulnerabilities exist because the web-based management interface does not properly validate user-supplied input. An attacker could exploit these vulnerabilities by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit these vulnerabilities, the attacker must have valid administrative credentials. | |
| Title | Cisco Packaged Contact Center Enterprise and Cisco Unified Contact Center Enterprise Cross-Site Scripting Vulnerability | |
| Weaknesses | CWE-79 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: cisco
Published:
Updated: 2026-01-21T16:46:11.154Z
Reserved: 2025-10-08T11:59:15.374Z
Link: CVE-2026-20109
Vulnrichment
Updated: 2026-01-21T16:45:42.982Z
NVD
Status : Awaiting Analysis
Published: 2026-01-21T17:16:08.723
Modified: 2026-01-26T15:04:59.737
Link: CVE-2026-20109
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-01-22T10:15:19Z