Description

A vulnerability in Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified Contact Center Enterprise (Unified CCE) could allow an authenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to send arbitrary network requests that are sourced from the affected device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device. 

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.0",
  "pubDate": "2026-08-19T17:18:39.677Z",
  "pubdate": "2026-08-19T17:18:39.677Z",
  "executiveSummary": "An authenticated, remote Server-Side Request Forgery (SSRF) vulnerability exists within Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified Contact Center Enterprise (Unified CCE).\nThe vulnerability allows authenticated remote attackers to leverage the vulnerable device as a proxy, forcing it to dispatch arbitrary network requests to internal or external resources.\nThe root cause stems from insufficient input validation enforced on specific incoming HTTP requests processed by the application.\nSuccessful exploitation requires the attacker to possess valid user credentials and network access to the affected device.\nThe realization of this vulnerability presents severe risk implications, potentially exposing internal network architecture, bypassing perimeter firewalls, or interacting with internal services that are otherwise inaccessible from external network zones.\nNo specific version numbers or external identifiers other than the affected product names were provided in the evaluation context.",
  "technicalDetails": "The vulnerability is classified as a Server-Side Request Forgery (SSRF) flaw, driven by improper input validation mechanisms handling specific HTTP requests submitted to the affected device.\nThe vulnerable components reside within the web application handling routines of Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified Contact Center Enterprise (Unified CCE).\nPrerequisites for exploitation dictate that an attacker must first authenticate against the targeted device using valid user credentials, establishing an authorized session or utilizing granted API access privileges.\nThe attack flow proceeds as follows: First, the authenticated attacker crafts a malicious HTTP request containing arbitrary target parameters within the input fields that lack rigorous validation. Second, the attacker transmits this crafted HTTP request across the network to the affected device. Third, the internal application logic parses the request and initiates an outbound network connection using the parameters supplied by the attacker. Finally, the affected device sources the outbound request, querying the targeted internal or external service on behalf of the attacker.\nThe payload behavior forces the underlying operating system or application runtime of the device to execute arbitrary network requests, potentially returning sensitive internal data to the attacker or facilitating lateral movement deeper into the enterprise infrastructure.\nNetwork exposure is bounded by the accessibility of the management or user interfaces exposed by Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified Contact Center Enterprise (Unified CCE).\nPost-exploitation impact includes the potential scanning of internal network segments, interaction with backend administrative services, data exfiltration, or secondary exploitation of vulnerable internal applications that trust traffic originating from the contact center infrastructure."
}