Security Advisory Desk
mediumQCS priority 82/100Cisco

Cisco Packaged Contact Center Enterprise and Cisco Unified Contact Center Enterprise Server-Side Request Forgery Vulnerability

Cisco discovered a security flaw in two of its contact center products that could let a person with a valid login trick the system into sending unauthorized network requests. This flaw happens because the system doesn't properly check certain web requests. Cisco has fixed this problem in updated software versions, and no temporary fixes are available.

Published 19/8/2026, 4:00:00 pmVerified 19/8/2026, 6:18:18 pmRevision 1
Cisco medium network security advisory visual

In plain language

What this advisory means

Cisco discovered a security flaw in two of its contact center products that could let a person with a valid login trick the system into sending unauthorized network requests. This flaw happens because the system doesn't properly check certain web requests. Cisco has fixed this problem in updated software versions, and no temporary fixes are available.

Technical explanation

How the issue affects the environment

The vulnerability exists in Cisco Packaged Contact Center Enterprise and Unified Contact Center Enterprise due to improper input validation of particular HTTP requests. Authenticated attackers with valid user credentials can send crafted HTTP requests that exploit this flaw to perform server-side request forgery (SSRF). This means they can make the affected system send arbitrary network requests on their behalf, potentially accessing internal resources or services. The Common Weakness Enumeration ID is CWE-918, and the vulnerability is identified as CVE-2026-20314 with a CVSS 3.1 base score of 5.0 (medium severity).

Operational impact

Why teams should care

Exploitation of this vulnerability allows attackers with valid credentials to make the contact center system send network requests they control. This may lead to unauthorized internal network access or lateral movement, increasing the risk of data exposure or further compromise. However, the vulnerability does not directly affect confidentiality but impacts system integrity with potential limited impacts.

Immediate action

Cisco recommends upgrading affected devices to the fixed software release 15.0(1)ES202607. This update addresses the input validation issue that allows SSRF attacks. Customers should obtain the update from Cisco or authorized channels and ensure devices meet memory and configuration requirements for the new release.

Affected and fixed releases

Affected versionsVersions earlier than 15.0
Fixed versions15.0(1)ES202607

Temporary risk reduction

Cisco states that no workarounds or temporary mitigations are available for this vulnerability. The only effective remediation is to upgrade to the fixed software release.

Evidence and validation checklist

  • Cisco Security Advisory cisco-sa-ucce-pcce-ssrf-TghHxD
  • Details about vulnerability cause and exploitation method
  • Affected and fixed software releases
  • Lack of workarounds specified
  • Acknowledgement of no known exploits as of publication

Authoritative reference

Cisco PSIRT Advisories

QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.

Open source
Cisco Packaged Contact Center Enterprise and | Advisory | QCS