Cisco UCCX Vulnerabilities Allow Remote Attackers to Execute Arbitrary Code

Cisco has issued a security advisory covering two severe vulnerabilities in its Unified CCX platform that could allow remote attackers to execute arbitrary commands and bypass authentication. The flaws, CVE-2025-20354 (Remote Code Execution) and CVE-2025-20358 (Authentication Bypass), carry CVSS scores of 9.8 and 9.4 respectively and affect Cisco Unified CCX versions 12.5 SU3 and earlier, and 15.0 and earlier.

An unauthenticated attacker exploiting these weaknesses could compromise an entire CCX deployment without credentials or user interaction, with CVE-2025-20354 enabling arbitrary file uploads and root-level command execution, while CVE-2025-20358 enables malicious scripts to run with administrative rights. The advisory notes that no workarounds exist and patching is required; organisations on 12.5 should upgrade to 12.5 SU3 ES07, and those on 15.0 should move to 15.0 ES01.

According to Cisco’s Product Security Incident Response Team (PSIRT), security researcher Jahmel Harris identified these vulnerabilities and reported them to Cisco. There are currently no known public exploits, but the urgency to apply updates remains high to protect CCX infrastructure. The vulnerabilities arise from improper authentication in the Java Remote Method Invocation process and underscore the need for immediate remediation.