CVE-2026-20175: Cisco Finesse RCE Vulnerability

CVE-2026-20175 Overview

CVE-2026-20175 is a remote file inclusion (RFI) vulnerability in Cisco Finesse. The flaw allows an unauthenticated, remote attacker to load arbitrary files from remote locations into an active user session. Successful exploitation can lead to browser-based attacks against authenticated Finesse users.

The vulnerability stems from insufficient validation of user-supplied input in HTTP requests sent to an affected device. An attacker must persuade a user to click a crafted link containing the address of the targeted Finesse instance. Successful exploitation can execute arbitrary script code in the context of the affected interface or expose sensitive information.

Critical Impact

An unauthenticated attacker can execute arbitrary script code in a victim's browser session and exfiltrate sensitive data accessible through the Finesse interface.

Affected Products

• Cisco Finesse (refer to the Cisco Security Advisory for fixed release information)

Discovery Timeline

• 2026-06-03 - CVE-2026-20175 published to the National Vulnerability Database (NVD)
• 2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-20175

Vulnerability Analysis

CVE-2026-20175 is classified under [CWE-73] (External Control of File Name or Path). Cisco Finesse fails to validate user-supplied input in specific HTTP request parameters. This allows an attacker to inject a remote file reference that the application loads into an authenticated user's session.

The vulnerability requires user interaction. An attacker crafts a malicious URL pointing to the Finesse host and embeds an externally controlled file location. When a logged-in agent or supervisor clicks the link, the application fetches and renders the attacker-supplied content within the trusted Finesse origin.

Because the loaded content executes in the security context of the Finesse interface, the attacker can run arbitrary JavaScript, manipulate the page DOM, and access session data. The scope change reflects that the impact crosses the trust boundary from the vulnerable Finesse component into the user's browser session.

Root Cause

The root cause is insufficient input validation on HTTP request parameters that control file or resource loading. The application accepts and processes attacker-controlled paths or URLs without verifying that the resource is internal or whitelisted. This produces a remote file inclusion condition combined with a reflected cross-site scripting vector.

Attack Vector

The attack vector is network-based and requires user interaction. The attacker must know the address of the targeted Finesse deployment. The attacker then sends a crafted link to a Finesse user through phishing, chat, email, or another delivery channel. Clicking the link loads remote attacker-controlled content into the authenticated Finesse session, enabling browser-based attacks.

No verified exploit code is publicly available. Refer to the Cisco Security Advisory for technical details and fixed software releases.

Detection Methods for CVE-2026-20175

Indicators of Compromise

• HTTP requests to the Finesse server containing URL parameters with external http:// or https:// references, encoded paths, or unusual file extensions.
• Outbound connections from Finesse user browsers to unfamiliar domains immediately after clicking a Finesse-hosted link.
• Unexpected script execution, DOM modifications, or session token access in Finesse browser sessions.

Detection Strategies

• Inspect web server and reverse proxy logs for Finesse request URIs containing remote URL parameters or path traversal sequences.
• Deploy web application firewall (WAF) rules that flag requests with externally hosted file references in Finesse endpoints.
• Correlate user click events on Finesse-origin links with subsequent outbound HTTP requests to non-corporate domains.

Monitoring Recommendations

• Enable verbose HTTP request logging on the Finesse server and forward logs to a centralized SIEM for parameter-level analysis.
• Monitor Content Security Policy (CSP) violation reports from Finesse user browsers.
• Track phishing reports and email gateway telemetry for messages containing crafted Finesse URLs from external senders.

How to Mitigate CVE-2026-20175

Immediate Actions Required

• Apply the fixed software release identified in the Cisco Security Advisory for Cisco Finesse.
• Restrict network access to the Finesse administrative and agent interfaces to trusted internal networks only.
• Educate agents and supervisors about phishing links that reference internal Finesse hostnames.

Patch Information

Cisco has published the security advisory cisco-sa-finesse-rfi-gwpkdc89 describing affected releases and remediated versions. Administrators should consult the advisory and upgrade Cisco Finesse to a fixed release. No official workarounds replace patching.

Workarounds

• Place Finesse behind a reverse proxy or WAF that strips or rejects request parameters containing external URLs.
• Enforce a strict Content Security Policy on the Finesse origin to block loading of remote scripts and frames from untrusted domains.
• Limit Finesse access to authenticated VPN users to reduce the attack surface available to unauthenticated remote attackers.

# Example WAF rule concept (ModSecurity-style) to block remote URL parameters
SecRule ARGS "@rx ^(https?|ftp)://" \
    "id:1002601,phase:2,deny,status:403,\
    msg:'Possible Finesse RFI attempt (CVE-2026-20175)',\
    tag:'CWE-73'"