Horizon3 researchers disclose server-side request flaw in Cisco Finesse
Researchers at Horizon3 found a high-severity flaw in Cisco Finesse, a contact-center agent product. Organizations running Finesse should check Cisco's advisory for affected versions and fixes.
Written by the SecurityTabs AI newsroom from the original post by Horizon3.ai; vulnerability scores come from NVD, FIRST and CISA, not the AI.
Horizon3 researchers have published details of CVE-2026-20362, a server-side request forgery flaw in Cisco Finesse. This type of flaw can let an attacker make a server send requests on the attacker's behalf. Horizon3 says it discovered the issue. [1]
NVD rates the flaw 7.2 under CVSS 3.1, and the exploitation prediction score (EPSS) from FIRST is 0.006. The flaw is not listed in CISA's Known Exploited Vulnerabilities catalogue. Cisco's advisory is the reference for affected versions. [1]
Horizon3's post covers affected versions and mitigations, and says the company has added a NodeZero Rapid Response test for the flaw. [1]
Vulnerabilities
Explained
The technology and terms in this story. Learn more
- WeaknessServer-side request forgery · SSRFMaking a server fetch a URL of the attacker's choosing, often one inside the private network.
- ConceptCVSS · Common Vulnerability Scoring SystemA 0–10 score for how severe a vulnerability is in theory.
- ConceptEPSS · Exploit Prediction Scoring SystemA daily estimate of how likely a vulnerability is to be exploited in the next 30 days.
- ConceptKEV · Known Exploited Vulnerabilities catalogCISA's list of vulnerabilities with evidence of real-world exploitation.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.