XSS in Cisco Packaged Contact Centre Enterprise and Unified Contact Center Enterprise is real and worth fixing. Cisco’s PSIRT advisory from 21 January 2026 says the web management interface did not validate some user-supplied input, which let an authenticated attacker run cross-site scripting against administrators of CUIC, CVP and other management pages. Cisco assigned CVE-2026-20055 and CVE-2026-20109 and gave both a CVSS base score of 4.8. Valid administrative credentials are needed, there were no workarounds, and Cisco released updates to fix the defects.
Finding the XSS is usually a matter of testing like an attacker. Use an authenticated proxy such as Burp or ZAP and record admin traffic through the web management console. Look at any form, query string or header that reflects text into a page used by admins. Start with simple payloads such as <script>alert(1)</script>, then try encoded and context-specific payloads for attribute and URL contexts. Automated scanners will catch some reflected XSS, but they miss a lot of stored or DOM-based issues in admin consoles. Run authenticated scans only; unauthenticated checks will miss this because exploitation needs credentials. Judge severity by the actual exposure: affected pages, reflected versus stored versus DOM-based behaviour, and whether an exploit can read admin cookies or act as that admin. A stored XSS that can perform actions is still a serious problem, even if the CVSS number looks modest.
Fixes sit in three places: code, configuration and access control. At the code layer, use output encoding for the exact HTML context. HTML-escape content, encode attributes for attribute values, encode JavaScript for inline scripts, and URL-encode query parameter inserts. Do not rely on blacklists; use whitelists where they make sense. At the configuration layer, put in a tight Content Security Policy that only permits scripts from trusted origins and blocks inline scripts where possible. Set admin cookies to Secure, HttpOnly and SameSite=strict. Force TLS with strong ciphers and HSTS. On the access side, cut down the attack surface: move web management off the public network, place it behind an admin jump host or management VPN, and restrict access by IP ACLs on the load balancer or firewall. Use least privilege for admin accounts and add multi-factor authentication for every account that can reach the management UI. Patch to the Cisco releases that address the CVEs. If patching has to wait, block access to the affected pages with a temporary WAF rule that strips or rejects suspicious input and logs attempts.
After patching, rerun an authenticated scan and a manual review of the same pages where the issues showed up. Check that injected payloads no longer execute and that cookies are not readable through document.cookie. Test session timeouts and concurrent session behaviour. Record the exact software versions you updated and track the change in configuration management. Log all admin UI requests, send them to a central collector and alert on unusual scripted activity. For longer-term hardening, add XSS test cases to CI for the web management code paths and run quarterly authenticated scans against the contact centre interfaces. Keep an eye on Cisco security advisories for related fixes and the exact fixed versions.
Act on the basics first: apply the Cisco updates for CVE-2026-20055 and CVE-2026-20109, restrict access to the web management plane, enforce MFA and least privilege for admin accounts, use context-aware output encoding with a strict CSP, and run authenticated scans plus manual tests against CUIC, CVP and the virtualised voice browser pages.
