PT-2026-3789 · Cisco · Cisco Packaged Contact Center Enterprise+1

Published 2026-01-21 · Updated 2026-01-21 · CVE-2026-20109

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified Contact Center Enterprise and Cisco Packaged Contact Center Enterprise (affected versions not specified)

Description The software contains insufficient protection of web page structure. Successful exploitation could allow a remote attacker to conduct cross-site scripting (XSS) attacks. The issue is due to improper validation of user-supplied input within the web-based management interface. An attacker could inject malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code or access sensitive, browser-based information. The attacker must have valid administrative credentials to exploit these issues.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-01760

CVE-2026-20109

Affected Products

Cisco Packaged Contact Center Enterprise

Cisco Unified Contact Center Enterprise

References · 3

• https://bdu.fstec.ru/vul/2026-01760 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-20109 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucce-pcce-xss-2JVyg3uD · Vendor Advisory