Medium [CVE-2026-20055 +1] Cisco Packaged Contact Center Enterprise and Cisco Unified Contact Center Enterprise Cross-Site Scripting Vulnerabilities
This medium-severity Cisco advisory covers CVE-2026-20055 and CVE-2026-20109 affecting Unified Contact Center Enterprise, Packaged Contact Center Enterprise.
Android app · Google Play
Monitor future Cisco CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Multiple vulnerabilities in the web-based management interface of Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified Contact Center Enterprise (Unified CCE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device.
These vulnerabilities exist because the web-based management interface does not properly validate user-supplied input. An attacker could exploit these vulnerabilities by injecting malicious code into specific pages of the interface.
A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit these vulnerabilities, the attacker must have valid administrative credentials.
Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
- Scope: At the time of publication, these vulnerabilities affected Cisco Packaged CCE and Cisco Unified CCE, regardless of device configuration.
- Earlier than 12.6 — Migrate to a fixed release
- 12.6 — 12.6(2)_ES101 / Migrate to a fixed release
- Release 15.0 (first fixed: 15.0(1)ES202511)
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
- 15.0(1)ES202511
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
Mitigation checklist
- Multiple vulnerabilities in the web-based management interface of Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified Contact Center Enterprise (Unified CCE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device.
- There are no workarounds that address these vulnerabilities.
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.