- Horizon3 researchers found that Cisco Finesse (CVE-2026-20362) lets an unauthenticated caller make the server fetch internal addresses and return the answers.
- Cisco lists no workaround, and as of October 27, 2026 fixed releases were still scheduled for January and February 2027.
- Until then, limit who can reach the Finesse web interface, and watch for unexpected requests from Finesse servers.
Inside the network, requests are often trusted
Many internal systems are built on one quiet assumption. A request from a trusted machine is treated as a legitimate request. CVE-2026-20362 in Cisco Finesse shows how fragile that assumption can be.
The lesson here is that a server can lend its trusted position to a stranger. Nobody has to break in.
What Horizon3 found
Horizon3 researchers Noah King and Brandon Peterson found a flaw in the web-based management interface of Cisco Finesse. It is a server-side request forgery, or SSRF.
In practice, a remote stranger with no login can send specially built web requests to an affected server. The server then fetches things for them. The researchers say the attacker gets back a limited amount of sensitive information from services linked to Finesse.
The CVSS v3.1 score is 7.2, rated High. CVSS is the standard severity scale. The attacker needs network access to the interface, but needs no login and no user interaction. Horizon3 says Finesse is affected whatever its configuration.
Cisco published its advisory on October 7, 2026, and credited the Horizon3 researchers. NVD, the US government's vulnerability database, published its record the same day. Cisco PSIRT reports no known malicious use.
How the flaw works
An SSRF attack tricks a server into making a request for the attacker. The server then passes the answer back. The attacker borrows the server's place on the network.
Horizon3 traced the problem to an embedded Apache Shindig content proxy. The proxy fetches any web address the caller gives it. It then returns the result to that unauthenticated caller. Horizon3 puts the root cause down to improper input validation.
The useful targets are services that outsiders cannot reach directly. One example in the report is the Finesse REST API on the server's own loopback address, 127.0.0.1:8082. Loopback is how a machine talks to itself.
A request to that service returns a SystemInfo response. It lists the deployment type, the primary and secondary node hostnames, and the XMPP domain. Horizon3 says this lets an attacker map the deployment.
The CVSS vector also marks the scope as changed (S:C). That means the impact reaches past the vulnerable component itself. Confidentiality and integrity impact are both scored Low. Availability impact is None.
There is a limit to what the example shows. It exposes names and settings, not records. The source does not say what sits behind other internal addresses. That depends on each organisation's network.
The harder problem is the wait
As of October 27, 2026, Horizon3 says no fixed release exists. Cisco's planned releases are due in January and February 2027. Cisco lists no workaround.
Two details matter for planning. Older software branches must move to a fixed release. Moving to an affected 15.0 release leaves the flaw in place.
So the vendor's patch cannot be the control for now. The control is who can reach the interface.
Horizon3 suggests two stopgaps. Limit the web interface to trusted networks or VPN connections that require a login. Also watch for requests from Finesse servers to internal services that nobody expected.
Horizon3 is clear on the limit. These steps cut the chances of exploitation. They do not repair the flaw.
Horizon3 also says Cisco Unified Intelligence Center is not affected.
Questions to put to your team
First, can anyone outside trusted networks reach the Finesse web interface today? If the answer is unclear, settle that first.
Second, which release branch do you run? Older branches need migration. The 15.0 caveat means an upgrade alone may not help. Ask for a plan that matches Cisco's advisory, which lists the planned releases.
Third, can you see outbound requests from Finesse servers to internal services? Without that record, misuse of the proxy would be hard to spot.
Fourth, how will you confirm the access limits work? Horizon3 sells a NodeZero Rapid Response test for this CVE, released October 27, 2026. It is the finder's commercial product. Whatever tool you use, test from the network locations that matter. Test again after the fix.
The flaw is Cisco's to repair. The months until the repair arrives belong to the owner. Until a fix exists, the network around the server is the main control Finesse owners have.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Horizon3.ai.
