# CVE-2026-20117: Cisco Unified CCX cross-site scripting in web management interface

Source: https://junglewise.ai/threats/cve-2026-20117-cisco-unified-ccx-cross-site-scripting-in-web-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-11. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-20117 · Severity: medium · CVSS 6.1 · Published 2026-03-11

Cisco Unified Contact Center Express (Unified CCX) is a platform used by businesses to manage customer interactions and contact center operations. A security flaw in its web management interface could allow an attacker to trick a user into executing malicious scripts. If successful, the attacker could gain access to sensitive information stored in the user's browser or perform actions on the user's behalf within the management system.

Technologies: [Cisco Unified Contact Center Express](https://junglewise.ai/threats/technologies/unified-contact-center-express). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-20117 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20117 being exploited in the wild.

**How severe is CVE-2026-20117?** Medium severity, with a CVSS score of 6.1, published 11 March 2026.

**Which products and versions are affected?** Cisco Unified Contact Center Express Up to and including 15.0(1)ES01.

**Is there a fix for CVE-2026-20117?** A patch was published on 2026-03-11: Fixed in 15.0 ES02 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-20117 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-20117?** Check whether you run Cisco Unified Contact Center Express at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A reflected cross-site scripting (XSS) vulnerability exists in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) due to insufficient validation of user-supplied input. An unauthenticated, remote attacker can exploit this by persuading a user of the interface to click a specially crafted link. Successful exploitation allows the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information such as session cookies. Cisco has released software updates to address this vulnerability in version 15.0 ES02 and recommends migrating from older, unsupported versions.

## Affected products

- Cisco Unified Contact Center Express (Unified CCX) Up to and including 15.0(1)ES01

## Timeline

- 2026-03-11: advisory: Initial public release by Cisco
- 2026-03-11: patched: Fixed in 15.0 ES02

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cc-xss-MrNAH5Jh](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cc-xss-MrNAH5Jh)

## Related threats

- [A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute…](https://junglewise.ai/threats/cve-2025-20376-a-vulnerability-in-the-web-ui-of-cisco-unified-ccx-could-allow-an)
- [A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute…](https://junglewise.ai/threats/cve-2025-20375-a-vulnerability-in-the-web-ui-of-cisco-unified-ccx-could-allow-an)
- [A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to perform a…](https://junglewise.ai/threats/cve-2025-20374-a-vulnerability-in-the-web-ui-of-cisco-unified-ccx-could-allow-an)
- [A vulnerability in the Contact Center Express (CCX) Editor application of Cisco Unified CCX could allow an…](https://junglewise.ai/threats/cve-2025-20358-a-vulnerability-in-the-contact-center-express-ccx-editor)
- [A vulnerability in the Java Remote Method Invocation (RMI) process of Cisco Unified CCX could allow an…](https://junglewise.ai/threats/cve-2025-20354-a-vulnerability-in-the-java-remote-method-invocation-rmi-process)