Multiple Cisco Unified CCX Vulnerabilities Enable Arbitrary Command Execution by Attackers

Two critical vulnerabilities in Cisco Unified Contact Center Express (Unified CCX) could allow unauthenticated, remote attackers to take control of affected systems, with the first being CVE-2025-20354, a Remote Code Execution flaw in the Java RMI process carrying a CVSS Base Score of 9.8, and the second CVE-2025-20358, an authentication bypass in the CCX Editor application with a CVSS Base Score of 9.4.

According to Cisco, these flaws enable attackers to upload arbitrary files and execute commands on the underlying operating system, or bypass authentication to obtain administrative permissions for script creation and execution. The issues affect Cisco Unified CCX systems regardless of device configuration, while Packaged Contact Center Enterprise and Unified Contact Center Enterprise are not affected.

Cisco has released patched versions—12.5 release line should upgrade to 12.5 SU3 ES07 or later, and 15.0 should upgrade to 15.0 ES01 or later—with no workarounds available. PSIRT states there is no evidence of public announcements or active exploitation at present, but the ease of access and potential impact mean urgent patching is advised.