CVE-2026-20175
Cisco Finesse File Inclusion Vulnerability
Description
A vulnerability in Cisco Finesse could allow an unauthenticated, remote attacker to load arbitrary files from remote locations into an active user session on an affected device, possibly leading to browser-based attacks. This vulnerability is due to insufficient validation of user-supplied input for HTTP requests that are sent to an affected device. An attacker who has knowledge of the address of the affected device could exploit this vulnerability by persuading a user to click a crafted link that contains the affected device address. A successful exploit could allow the attacker to conduct browser-based attacks and execute arbitrary script code in the context of the affected interface or access sensitive information on the affected device.
Weakness: CWE-73
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Cisco | Cisco Contact Center | Other Products | cna-assigner |
Vendor-reported products (1)
- Cisco · Cisco Finesse
Vendor advisory
Cisco Finesse Remote File Inclusion Vulnerability
Cisco’s rating: Medium (advisory CVSS 6.1) · Published Jun 3, 2026 · updated Jun 25, 2026 (revision 1.1)
Bug ID: CSCws76655
The vendor’s rating applies to the whole advisory and can differ from this CVE’s own CVSS severity. Where this comes from