CVE-2026-20175— Cisco Finesse File Inclusion Vulnerability
Possible ATT&CK Techniques 2AI
T1189 · Drive-by Compromise T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 91
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Cisco | Cisco Finesse | 11.0(1)ES_Rollback | affected |
10.5(1)ES4 | affected | ||
11.6(1)ES3 | affected | ||
11.0(1)ES2 | affected | ||
12.0(1)ES2 | affected | ||
10.5(1)ES3 | affected | ||
11.0(1) | affected | ||
11.6(1)FIPS | affected | ||
| … +83 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-20175
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cisco Finesse File Inclusion Vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
A vulnerability in Cisco Finesse could allow an unauthenticated, remote attacker to load arbitrary files from remote locations into an active user session on an affected device, possibly leading to browser-based attacks. This vulnerability is due to insufficient validation of user-supplied input for HTTP requests that are sent to an affected device. An attacker who has knowledge of the address of the affected device could exploit this vulnerability by persuading a user to click a crafted link that contains the affected device address. A successful exploit could allow the attacker to conduct browser-based attacks and execute arbitrary script code in the context of the affected interface or access sensitive information on the affected device.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
文件名或路径的外部可控制
Source: NVD (National Vulnerability Database)
Vulnerability Title
Cisco Finesse 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco Finesse是美国思科（Cisco）公司的一套呼叫中心管理软件。 Cisco Finesse存在安全漏洞，该漏洞源于对用户提供的HTTP请求输入验证不足，可能导致未经身份验证的远程攻击者加载远程文件，进而进行基于浏览器的攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Cisco | Cisco Finesse | 11.0(1)ES_Rollback | - |
II. Public POCs for CVE-2026-20175
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-20175
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-20175 (1)
Same Patch Batch · Cisco · 2026-06-03 · 3 CVEs total
| CVE-2026-20230 | 8.6 HIGH | Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability |
| CVE-2026-20233 | 6.1 MEDIUM | Cisco Webex Meetings Cross-Site Scripting Vulnerability |
IV. Related Vulnerabilities
Same product: Cisco Finesse
- CVE-2025-20278
Cisco Unified Communications Products Command Injection Vuln - CVE-2020-3159
Cisco Finesse Web-Based Management Interface Cross-Site Scri - CVE-2019-15278
Cisco Finesse Cross-Site Scripting Vulnerability - CVE-2019-12632
Cisco Finesse Request Processing Server-Side Request Forgery - CVE-2017-6761
Cisco Finesse 跨站脚本漏洞
Same vendor: Cisco
- CVE-2026-20243
ClamAV ALZ Archive Processing Denial of Service Vulnerabilit - CVE-2026-20244
ClamAV DMG File Processing Denial of Service Vulnerability - CVE-2026-20215
ClamAV 7Zip File Format Processing Out-of-Bounds Memory Corr - CVE-2026-20217
ClamAV PESpin File Format Processing Out-of-Bounds Memory Co - CVE-2026-20216
ClamAV InstallShield File Format Processing Resource Exhaust
Same weakness: CWE-73
- CVE-2026-58293
Microsoft Edge (Chromium-based) Remote Code Execution Vulner - CVE-2026-8921
ASUS Business Manager外部控制文件名漏洞 - CVE-2026-5821
Image Optimizer <= 1.7.4 - Authenticated (Author+) Arbitrary - CVE-2026-55628
ImageMagick: Policy Bypass in concatenate operation due to m - CVE-2026-12480
Arbitrary HDF5 File Read via Virtual Dataset Bypass in keras
V. Comments for CVE-2026-20175
No comments yet