PT-2026-33091 · Cisco · Webex Contact Center

Published 2026-04-15 · Updated 2026-04-16 · CVE-2026-20170

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Webex Contact Center (affected versions not specified)

Description An issue in the Desktop Agent functionality allows an unauthenticated remote attacker to perform cross-site scripting (XSS), which is a technique where malicious scripts are injected into trusted websites. This occurs because HTML and script content are not properly handled. An attacker could exploit this by persuading a user to click a malicious link, potentially leading to the theft of sensitive browser data, such as authentication and session information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-80

Related Identifiers

BDU:2026-05634

CVE-2026-20170

Affected Products

Webex Contact Center

References · 4

• https://bdu.fstec.ru/vul/2026-05634 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webexcc-xss-WEX5nUnA · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-20170 · Security Note
• https://twitter.com/CVEnew/status/2044737957249024286 · Twitter Post