CVE-2026-20116
Multiple Cisco Contact Center Products Cross-Site Scripting Vulnerabilities
A vulnerability in the web-based management interface of Cisco Finesse, Cisco Packaged Contact Center Enterprise (Packaged CCE), Cisco Unified Contact Center Enterprise (Unified CCE), Cisco Unified Contact Center Express (Unified CCX), and Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. This vulnerability exists because the web-based management interface of an affected system does not sufficiently validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
| CWE | CWE-79 |
| Vendor | cisco |
| Product | cisco unified contact center express |
| Ecosystems | |
| Industries | NetworkingTelecommunications |
| Published | Mar 11, 2026 |
| Last Updated | Mar 11, 2026 |
Get instant alerts for cisco cisco unified contact center express
Be the first to know when new medium vulnerabilities affecting cisco cisco unified contact center express are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N