CVE intelligence

CVE-2026-20314

Vulnerability intelligence

Published Aug 19, 2026Sources checked Oct 27, 2026

5.0MEDIUMCVSS out of 10

What this means

Review the available evidence

CVE-2026-20314 and is rated Medium severity with a CVSS score of 5.0. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Cisco Security Advisories guidance

Vendor revision: Aug 19, 2026

Vendor remediation details

On August 19, 2026, the Cisco Product Security Incident Response Team (PSIRT) published the following advisories: Cisco Security Advisory CVE ID Security Impact Rating CVSS Base Score Cisco Crosswork Security Hardening Release: August 2026 CVE-2026-20030CVE-2026-20357CVE-2026-20358CVE-2026-20359 Critical 10.0 Cisco Secure Workload Software Security Hardening Release: August 2026 CVE-2026-20231CVE-2026-20315CVE-2026-20317CVE-2026-20318CVE-2026-20319 Critical 10.0 Cisco BroadWorks Out-of-Band Blind XML External Entity Injection Vulnerability CVE-2026-20320 High 7.5 Cisco Unified Intelligence Center SQL Injection Vulnerability CVE-2026-20327 Medium 6.5 Cisco RoomOS Stack Overflow Vulnerability CVE-2026-20302 Medium 6.1 Cisco Industrial Ethernet 1000 Series Switches Stored Cross-Site Scripting

Cisco Security Advisories guidance

Vendor revision: Aug 19, 2026

Cisco has released software updates that address this vulnerability.

CISA KEVNot listedBased on the latest collected catalog

EPSS0.4%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-20314?

A vulnerability in Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified Contact Center Enterprise (Unified CCE) could allow an authenticated, remote attacker to conduct server-side request forgery (SSRF) attacks through an affected device.

This vulnerability is due to improper input validation for specific HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device.

A successful exploit could allow the attacker to send arbitrary network requests that are sourced from the affected device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device.

Source: NVD