CVE-2026-20117

MediumCVSS 6.1/10Last modified Jul 8, 2026

Description

A vulnerability in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. This vulnerability exists because the web-based management interface of an affected system does not sufficiently validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
CiscoCisco Unified Contact Center Express10.5(1)SU1; 10.6(1); 11.6(1); 10.6(1)SU1; 10.6(1)SU3; 11.6(2); 12.0(1); 11.0(1)SU1; 11.5(1)SU1; 10.5(1); 12.5(1); 12.5(1)SU1; 12.5(1)SU2; 12.5(1)SU3; 12.5(1)_SU03_ES01; 12.5(1)_SU03_ES02; 12.5(1)_SU02_ES03; 12.5(1)_SU02_ES04; 12.5(1)_SU02_ES02; 12.5(1)_SU01_ES02

References

Timeline

Published
Mar 11, 2026
Last modified
Jul 8, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-201186.8A vulnerability in the handling of an Egress Packet Network Interface (EPNI) Aligner interrupt in Cisco IOS XR Software for Cisco Network CoCVE-2026-201197.5A vulnerability in the text rendering subsystem of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could aCVE-2026-20129.8A vulnerability was determined in itsourcecode Student Management System 1.0. The impacted element is an unknown function of the file /ramonCVE-2026-201205.8A vulnerability in the access control list (ACL) Object Group Search (OGS) implementation of Cisco Secure Firewall Adaptive Security ApplianCVE-2026-201215.3A vulnerability in the access control list (ACL) Object Group Search (OGS) implementation of Cisco Secure Firewall Adaptive Security ApplianCVE-2026-201225.4A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on thCVE-2026-201236.1A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure coCVE-2026-201247.7A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE Software could allow an authenticated, remote attCVE-2026-201257.7A vulnerability in the HTTP Server feature of Cisco IOS Software and Cisco IOS XE Software Release 3E could allow an authenticated, remote aCVE-2026-201267.8A vulnerability in Cisco Catalyst SD-WAN Manager could allow an authenticated, local attacker with low privileges to gain root privileges onCVE-2026-2012710.0A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, foCVE-2026-201287.5A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker
CVE-2026-20117: Medium severity, CVSS 6.1 | Vulnix