Description
A vulnerability in the web-based management interface of  Cisco Finesse, Cisco Packaged Contact Center Enterprise (Packaged CCE), Cisco Unified Contact Center Enterprise (Unified CCE), Cisco Unified Contact Center Express (Unified CCX), and Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface.

This vulnerability exists because the web-based management interface of an affected system does not sufficiently validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Published: 2026-03-11
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting (XSS)
Action: Patch Now
AI Analysis

Impact

This vulnerability is a stored cross‑site scripting (XSS) flaw in the web‑based management interface of several Cisco Contact Center products. It allows an unauthenticated, remote attacker to inject and execute arbitrary script code within the context of the interface, potentially accessing sensitive browser‑based data. The weakness stems from insufficient input validation (CWE‑79).

Affected Systems

Affected products include Cisco Unified Contact Center Express, Cisco Unified Contact Center Enterprise, Cisco Packaged Contact Center Enterprise, Cisco Finesse, and Cisco Unified Intelligence Center. Specific vulnerable versions are not provided in the data.

Risk and Exploitability

The CVSS v3.1 score is 6.1, indicating moderate severity. EPSS is less than 1%, indicating a low probability of exploitation at current time. The vulnerability is not listed in the CISA KEV catalog. Attackers must first reach the web interface, which is typically exposed through port 8443/443; authentication is not required, so anyone can inject the payload. The impact is limited to the affected user's browser session unless the attacker can move laterally to compromise the underlying system.

Generated by OpenCVE AI on March 17, 2026 at 15:09 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update your Cisco Contact Center products to the latest releases that contain the XSS fix, as detailed in the Cisco Security Advisory.
  • Restrict access to the web‑based management interface by limiting it to trusted network segments or using VPN access only.
  • Deploy a Web Application Firewall (WAF) or content filtering solution to block cross‑site scripting payloads and monitor for injection attempts.

Generated by OpenCVE AI on March 17, 2026 at 15:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 12 Mar 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Cisco
Cisco unified Contact Center Express
Vendors & Products Cisco
Cisco unified Contact Center Express

Wed, 11 Mar 2026 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 11 Mar 2026 17:00:00 +0000

Type Values Removed Values Added
Description A vulnerability in the web-based management interface of&nbsp; Cisco Finesse, Cisco Packaged Contact Center Enterprise (Packaged CCE), Cisco Unified Contact Center Enterprise (Unified CCE), Cisco Unified Contact Center Express (Unified CCX), and Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. This vulnerability exists because the web-based management interface of an affected system does not sufficiently validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Title Multiple Cisco Contact Center Products Cross-Site Scripting Vulnerabilities
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Cisco Unified Contact Center Express
cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published:

Updated: 2026-03-11T17:20:21.361Z

Reserved: 2025-10-08T11:59:15.376Z

Link: CVE-2026-20116

cve-icon Vulnrichment

Updated: 2026-03-11T17:14:21.279Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-03-11T17:16:55.730

Modified: 2026-03-12T21:08:22.643

Link: CVE-2026-20116

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-20T15:30:29Z

Weaknesses