PT-2026-3786 · Cisco · Cisco Packaged Contact Center Enterprise+1

Published 2026-01-21 · Updated 2026-01-21 · CVE-2026-20055

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified Contact Center Enterprise (affected versions not specified)

Description The software contains weaknesses in the web-based management interface due to improper validation of user-supplied input. This could allow a remote attacker with administrative credentials to conduct a cross-site scripting (XSS) attack against a user of the interface. A successful exploit may allow the attacker to execute arbitrary script code or access sensitive, browser-based information. The attacker must have valid administrative credentials to exploit these weaknesses.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-01763

CVE-2026-20055

Affected Products

Cisco Packaged Contact Center Enterprise

Cisco Unified Contact Center Enterprise

References · 3

• https://bdu.fstec.ru/vul/2026-01763 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-20055 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucce-pcce-xss-2JVyg3uD · Vendor Advisory