9.8 Critical

CVE-2025-20354 Cisco Unified Contact Center Express Remote Code Execution Vulnerability

Description

A vulnerability in the Java Remote Method Invocation (RMI) process of Cisco Unified CCX could allow an unauthenticated, remote attacker to upload arbitrary files and execute arbitrary commands with root permissions on an affected system. This vulnerability is due to improper authentication mechanisms that are associated to specific Cisco Unified CCX features. An attacker could exploit this vulnerability by uploading a crafted file to an affected system through the Java RMI process. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system and elevate privileges to root.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: Low
Privileges required: None
Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Affected products and versions

Product	Affected versions	Fixed in
Cisco Unified Contact Center Express	Versions not published

References

cisco-sa-cc-unauth-rce-QeN8h7mQ sec.cloudapps.cisco.com

Timeline

Published November 5, 2025
Last modified November 3, 2026

The 36 CVEs of Cisco Unified Contact Center Express →

CVE-2026-20117 A vulnerability in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could… 6.1 Medium CVE-2026-20116 A vulnerability in the web-based management interface of  Cisco Finesse, Cisco Packaged Contact Center Enterprise… 6.1 Medium CVE-2025-20377 A vulnerability in the API subsystem of Cisco Unified Intelligence Center could allow an authenticated, remote… 4.3 Medium CVE-2025-20375 Cisco Unified Contact Center Express Arbitrary File Upload Vulnerability 6.5 Medium

Track this CVE