Cross-Site Scripting Vulnerability in Cisco Packaged Contact Center and Unified Contact Center
CVE-2026-20055

4.8MEDIUM

Key Information:

Vendor

Cisco
Status
Cisco Packaged Contact Center Enterprise
Cisco Unified Contact Center Enterprise
Vendor
CVE Published:
21 January 2026

Badges

👾 Exploit Exists

What is CVE-2026-20055?

A vulnerability exists in the web-based management interface of Cisco's Packaged Contact Center Enterprise and Unified Contact Center Enterprise. This flaw arises from inadequate validation of user-supplied input, allowing an authenticated remote attacker to perform cross-site scripting attacks. By injecting malicious scripts into specific pages of the interface, the attacker can execute arbitrary code in the context of the affected interface or access sensitive information stored in the user's browser. Exploitation of this vulnerability requires valid administrative credentials.

Affected Version(s)

Cisco Packaged Contact Center Enterprise 12.5(1)

Cisco Packaged Contact Center Enterprise 11.0(1)

Cisco Packaged Contact Center Enterprise 12.0(1)

References

https://sec.cloudapps.cisco.com/security/center/content/C...

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.