CVE-2026-20170

A vulnerability in the Desktop Agent functionality of Cisco Webex Contact Center could have allowed an unauthenticated, remote attacker to conduct cross-site scripting attacks. Cisco has addressed this vulnerability in the Cisco Webex Contact Center service, and no customer action is needed. This vulnerability existed because HTML and script content was not properly handled. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by persuading a user to follow a malicious link. A successful exploit could have allowed the attacker to steal sensitive information from the browser, including authentication and session information.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webexcc-xss-WEX5nUnA	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:cisco:webex_contact_center:-:*:*:*:cloud-based:*:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad en la funcionalidad de Desktop Agent de Cisco Webex Contact Center podría haber permitido a un atacante remoto no autenticado realizar ataques de cross-site scripting. Cisco ha abordado esta vulnerabilidad en el servicio de Cisco Webex Contact Center, y no se requiere ninguna acción por parte del cliente. Esta vulnerabilidad existía porque el contenido HTML y de script no se manejaba correctamente. Antes de que se abordara esta vulnerabilidad, un atacante podría haber explotado esta vulnerabilidad persuadiendo a un usuario para que siguiera un enlace malicioso. Un exploit exitoso podría haber permitido al atacante robar información sensible del navegador, incluyendo información de autenticación y de sesión.

Information

Published : 2026-04-15 17:17

Updated : 2026-10-26 22:10

NVD link : CVE-2026-20170

Mitre link : CVE-2026-20170

CVE.ORG link : CVE-2026-20170

JSON object : View

Products Affected

cisco

webex_contact_center

CWE

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

{"id": "CVE-2026-20170", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-20170", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T16:42:50.336172Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@cisco.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@cisco.com", "affectedData": [{"vendor": "Cisco", "product": "Cisco Webex Contact Center", "versions": [{"status": "affected", "version": "N/A"}]}]}], "published": "2026-04-15T17:17:03.297", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webexcc-xss-WEX5nUnA", "tags": ["Vendor Advisory"], "source": "psirt@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@cisco.com", "description": [{"lang": "en", "value": "CWE-80"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the Desktop Agent functionality of Cisco Webex Contact Center could have allowed an unauthenticated, remote attacker to conduct cross-site scripting attacks. Cisco has addressed this vulnerability in the Cisco Webex Contact Center service, and no customer action is needed.\r\n\r This vulnerability existed because HTML and script content was not properly handled. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by persuading a user to follow a malicious link. A successful exploit could have allowed the attacker to steal sensitive information from the browser, including authentication and session information."}, {"lang": "es", "value": "Una vulnerabilidad en la funcionalidad de Desktop Agent de Cisco Webex Contact Center podr\u00eda haber permitido a un atacante remoto no autenticado realizar ataques de cross-site scripting. Cisco ha abordado esta vulnerabilidad en el servicio de Cisco Webex Contact Center, y no se requiere ninguna acci\u00f3n por parte del cliente.\nEsta vulnerabilidad exist\u00eda porque el contenido HTML y de script no se manejaba correctamente. Antes de que se abordara esta vulnerabilidad, un atacante podr\u00eda haber explotado esta vulnerabilidad persuadiendo a un usuario para que siguiera un enlace malicioso. Un exploit exitoso podr\u00eda haber permitido al atacante robar informaci\u00f3n sensible del navegador, incluyendo informaci\u00f3n de autenticaci\u00f3n y de sesi\u00f3n."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:webex_contact_center:-:*:*:*:cloud-based:*:*:*", "vulnerable": true, "matchCriteriaId": "C152A05A-CA52-4D69-9531-B577E25B4192"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@cisco.com"}