Critical Cisco CCX RCE Flaws (CVSS 9.8) Allow Unauthenticated Root Access via Java RMI and CCX Editor

Cisco has released urgent security updates to address two critical vulnerabilities in its Unified Contact Center Express (Unified CCX) that could allow unauthenticated remote attackers to execute arbitrary code or gain administrative control over affected systems.

According to Cisco’s advisory, multiple vulnerabilities in the Java Remote Method Invocation (RMI) process could allow an unauthenticated, remote attacker to upload arbitrary files, bypass authentication, execute arbitrary commands, and elevate privileges to root. The flaws are tracked as CVE-2025-20354 and CVE-2025-20358 and affect multiple releases of Unified CCX. CVE-2025-20354 carries a CVSS score of 9.8, while CVE-2025-20358, which affects the CCX Editor application, is rated 9.4 (Critical).

Fixed software has been released in Unified CCX 12.5 SU3 ES07 and 15.0 ES01, and there are no workarounds available, with the PSIRT stating it is not aware of any public announcements or active exploitation at the time of publication.