CVE-2026-20314

MEDIUM 5 ALL-YEARS

Published 2026-08-19 · Last modified 2026-08-19 · cisco · NVD: Awaiting Analysis

A vulnerability in Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified Contact Center Enterprise (Unified CCE) could allow an authenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to send arbitrary network requests that are sourced from the affected device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device. 

LIMITED SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.4%chance of exploitation in 30 days · 38th percentile

○ In CISA KEV○ Catalogued PoC◆ SSVC: exploitation none, automatable no

Impact if exploited

5CVSS 3.1 · MEDIUM · CNA

ConfidentialityNone
IntegrityLow
AvailabilityNone

What an attacker needs

✓Access: Reachable over the network — no local access needed
⚠Privileges: Requires a low-privilege account
✓User interaction: No user interaction needed
✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Affected

Vendors Cisco

Products Cisco Packaged Contact Center Enterprise Cisco Unified Contact Center Enterprise

Weakness (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

References and research data (JSON)

All CVSS metrics

MEDIUM 5 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
MEDIUM 5 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

References

Advisories

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-62573 ADVISORYEUVD · EUVD-2026-62573

Technical & other

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucce-pcce-ssrf-TghHxDCVE record · cisco · Updated 2026-08-19T16:20:34.434Z
NVD · CVE-2026-20314 · Updated 2026-08-20T13:01:19.947

Sources: NVD · CVE.org · All sources and attribution · EPSS