CVE-2026-20109 - Cisco Packaged Contact Center Enterprise and Cisco Unified Contact Center Enterprise Cross-Site Scripting Vulnerability

Back Back to CVE browser

MEDIUM

Cisco Packaged Contact Center Enterprise and Cisco Unified Contact Center Enterprise Cross-Site Scripting Vulnerability

Published Jan 21, 2026

4.8

MEDIUM

CVSS 3.1

EPSS 0.20%

Description

Multiple vulnerabilities in the web-based management interface of Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified Contact Center Enterprise (Unified CCE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device.  These vulnerabilities exist because the web-based management interface does not properly validate user-supplied input. An attacker could exploit these vulnerabilities by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit these vulnerabilities, the attacker must have valid administrative credentials.

Affected products

Vendor Cisco Product Cisco Packaged Contact Center Enterprise Default
n/a
- Version
  10.5(1)
  Status
  affected
  Constraints
  -
- Version
  10.5(1)_ES7
  Status
  affected
  Constraints
  -
- Version
  10.5(2)
  Status
  affected
  Constraints
  -
- Version
  10.5(2)_ES8
  Status
  affected
  Constraints
  -
- Version
  11.0(1)
  Status
  affected
  Constraints
  -
- Version
  11.0(2)
  Status
  affected
  Constraints
  -
- Version
  11.5(1)
  Status
  affected
  Constraints
  -
- Version
  11.6(1)
  Status
  affected
  Constraints
  -
- Version
  11.6(2)
  Status
  affected
  Constraints
  -
- Version
  12.0(1)
  Status
  affected
  Constraints
  -
- Version
  12.5(1)
  Status
  affected
  Constraints
  -
- Version
  12.5(2)
  Status
  affected
  Constraints
  -
- Version
  12.6(1)
  Status
  affected
  Constraints
  -
- Version
  12.6(2)
  Status
  affected
  Constraints
  -
- Version
  15.0(1)
  Status
  affected
  Constraints
  -
Vendor Cisco Product Cisco Unified Contact Center Enterprise Default
n/a
- Version
  10.5
  Status
  affected
  Constraints
  -
- Version
  10.5(1)
  Status
  affected
  Constraints
  -
- Version
  11.0
  Status
  affected
  Constraints
  -
- Version
  11.0(1)
  Status
  affected
  Constraints
  -
- Version
  11.5
  Status
  affected
  Constraints
  -
- Version
  12.0(1)
  Status
  affected
  Constraints
  -
- Version
  12.5(1)
  Status
  affected
  Constraints
  -
- Version
  12.5(1)ES1
  Status
  affected
  Constraints
  -
- Version
  12.6(1)
  Status
  affected
  Constraints
  -
- Version
  12.6(1)ES1
  Status
  affected
  Constraints
  -
- Version
  12.6(1)ES2
  Status
  affected
  Constraints
  -
- Version
  12.6(1)ES3
  Status
  affected
  Constraints
  -
- Version
  12.6(1)ES4
  Status
  affected
  Constraints
  -
- Version
  12.6(1)SecurityPatch
  Status
  affected
  Constraints
  -
- Version
  12.6(2)
  Status
  affected
  Constraints
  -
- Version
  12.6(2)ES1
  Status
  affected
  Constraints
  -
- Version
  12.6(2)ES2
  Status
  affected
  Constraints
  -
- Version
  12.6(2)ES3
  Status
  affected
  Constraints
  -
- Version
  12.6(2)_ES
  Status
  affected
  Constraints
  -
- Version
  15.0(1)
  Status
  affected
  Constraints
  -
- Version
  15.0(1)ES202508
  Status
  affected
  Constraints
  -
- Version
  15.0(1)ET01
  Status
  affected
  Constraints
  -
- Version
  15.0(1)_SP1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Cisco

Cisco Packaged Contact Center Enterprise

n/a

Version	Status	Constraints
10.5(1)	affected	-
10.5(1)_ES7	affected	-
10.5(2)	affected	-
10.5(2)_ES8	affected	-
11.0(1)	affected	-
11.0(2)	affected	-
11.5(1)	affected	-
11.6(1)	affected	-
11.6(2)	affected	-
12.0(1)	affected	-
12.5(1)	affected	-
12.5(2)	affected	-
12.6(1)	affected	-
12.6(2)	affected	-
15.0(1)	affected	-

Cisco

Cisco Unified Contact Center Enterprise

n/a

Version	Status	Constraints
10.5	affected	-
10.5(1)	affected	-
11.0	affected	-
11.0(1)	affected	-
11.5	affected	-
12.0(1)	affected	-
12.5(1)	affected	-
12.5(1)ES1	affected	-
12.6(1)	affected	-
12.6(1)ES1	affected	-
12.6(1)ES2	affected	-
12.6(1)ES3	affected	-
12.6(1)ES4	affected	-
12.6(1)SecurityPatch	affected	-
12.6(2)	affected	-
12.6(2)ES1	affected	-
12.6(2)ES2	affected	-
12.6(2)ES3	affected	-
12.6(2)_ES	affected	-
15.0(1)	affected	-
15.0(1)ES202508	affected	-
15.0(1)ET01	affected	-
15.0(1)_SP1	affected	-