PT-2026-24731 · Cisco · Cisco Unified Contact Center Express+4

Jahmel Harris · Published 2026-03-11 · Updated 2026-03-13 · CVE-2026-20116

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Finesse Cisco Packaged Contact Center Enterprise (Packaged CCE) Cisco Unified Contact Center Enterprise (Unified CCE) Cisco Unified Contact Center Express (Unified CCX) Cisco Unified Intelligence Center (affected versions not specified)

Description A flaw exists in the web-based management interface of the listed Cisco products. This issue could allow a remote, unauthenticated attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. The root cause is insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this by injecting malicious code into specific pages of the interface. Successful exploitation may allow the attacker to execute arbitrary script code within the context of the affected interface or gain access to sensitive information accessible through the browser.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-05204

CVE-2026-20116

Affected Products

Cisco Finesse

Cisco Packaged Contact Center Enterprise

Cisco Unified Contact Center Enterprise

Cisco Unified Contact Center Express

Cisco Unified Intelligence Center

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-20116 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cc-xss-MrNAH5Jh · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05204 · Security Note
• https://twitter.com/CVEnew/status/2032410991561154669 · Twitter Post
• https://t.me/CVEtracker/47138 · Telegram Post