CVE-2026-20175: cisco cisco finesse External Control of File Name or Path

Vulnerability summary

CVE-2026-20175 is a medium (CVSS 6.1) External Control of File Name or Path vulnerability in cisco cisco finesse. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7% of scored vulnerabilities.

Timeline

1. 03-06-2026
   PublishedVulnerability first disclosed.
2. 03-06-2026
   Last modifiedVulnerability information updated.

Description

A vulnerability in Cisco Finesse could allow an unauthenticated, remote attacker to load arbitrary files from remote locations into an active user session on an affected device, possibly leading to browser-based attacks. This vulnerability is due to insufficient validation of user-supplied input for HTTP requests that are sent to an affected device. An attacker who has knowledge of the address of the affected device could exploit this vulnerability by persuading a user to click a crafted link that contains the affected device address. A successful exploit could allow the attacker to conduct browser-based attacks and execute arbitrary script code in the context of the affected interface or access sensitive information on the affected device.

• CWE-73External Control of File Name or PathThe product allows user input to control or influence paths or file names that are used in filesystem operations.