Cisco Finesse SSRF CVE-2026-20362 won't be patched until 2027

Cisco Finesse's web management interface has an unauthenticated server-side request forgery flaw, CVE-2026-20362, rated 7.2 on CVSS v3. Fixed releases are scheduled for January and February 2027, and Cisco lists no workarounds, leaving admins to rely on compensating controls.

• CVE-2026-20362 is an unauthenticated SSRF rated 7.2 with scope changed
• Fixes: Finesse 15.0(1) SU3 and Unified CCX 15.0(1) SU2 in February 2027
• Packaged CCE and Unified CCE 15.0(1)ES202701 arrive in January 2027
• Version 12.6 and earlier must migrate; no workarounds offered