Loading story…
A critical remote code execution (RCE) vulnerability has been identified in Cisco Unified Contact Center Express (CCX), tracked as CVE-2025-20354, with a CVSS score of 9.8. The flaw resides in the Java Remote Method Invocation (RMI) process and the CCX Editor, allowing unauthenticated attackers to upload arbitrary files and execute commands with root privileges on affected systems. The vulnerability is caused by improper authentication mechanisms associated with specific CCX features, making exploitation possible without prior access or credentials.
Successful exploitation enables remote attackers to gain full control over the underlying operating system, significantly increasing the risk of compromise for organizations using vulnerable Cisco CCX deployments. Cisco has acknowledged the issue and affected products, and organizations are urged to review their exposure and apply available mitigations or patches to prevent unauthorized root access and potential system takeover.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Alongside the advisory and patches, Cisco PSIRT stated it was not aware of in-the-wild exploitation of the UCCX vulnerabilities at the time of disclosure. Multiple reports repeated this assessment while urging organizations to patch quickly.
Cisco released security updates for Unified Contact Center Express to fix CVE-2025-20354 and CVE-2025-20358, two critical flaws that could let unauthenticated attackers bypass authentication and achieve high-privilege code execution. Fixed versions include v15.0 ES01 and v12.5 SU3 ES07, and Cisco said no workarounds are available.
Security researcher Jahmel Harris privately reported critical vulnerabilities affecting Cisco Unified Contact Center Express, including CVE-2025-20354 and CVE-2025-20358. The references do not specify the exact disclosure date.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
9 references tracked. Mallory keeps watching after this page renders.
thecyberexpress.com
Open sourcethecyberthrone.in
Open sourcesecurityaffairs.com
Open sourcehelpnetsecurity.com
Open sourcecsoonline.com
Open sourcecisecurity.org
Open sourcesecurityonline.info
Open sourcebleepingcomputer.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco released fixes for a **critical remote code execution** vulnerability in Unified Communications and *Webex Calling Dedicated Instance*, tracked as **CVE-2026-20045**, after it was **actively exploited as a zero-day**. The issue stems from **improper validation of user-supplied input in HTTP requests** to the web-based management interface; successful exploitation can provide **user-level OS access** and enable **privilege escalation to root**. Affected products include **Cisco Unified Communications Manager (Unified CM)**, **Unified CM Session Management Edition (SME)**, **Unified CM IM & Presence**, **Cisco Unity Connection**, and **Webex Calling Dedicated Instance**; Cisco provided version-specific remediations including fixed releases and `.cop` patch files (e.g., `ciscocm.V14SU4a_CSCwr21851_remote_code_v1.cop.sha512`). CISA added **CVE-2026-20045** to its **Known Exploited Vulnerabilities (KEV) Catalog**, citing evidence of active exploitation and highlighting code injection flaws as a common attack vector with significant risk to the federal enterprise. Under **Binding Operational Directive (BOD) 22-01**, Federal Civilian Executive Branch agencies are required to remediate KEV-listed vulnerabilities by the specified due date, and CISA urged all organizations to similarly prioritize patching to reduce exposure to ongoing attacks.
Jul 23, 2026
Cisco disclosed **CVE-2026-20230**, a server-side request forgery vulnerability in **Cisco Unified Communications Manager (Unified CM)** and **Unified CM Session Management Edition (Unified CM SME)** that can be exploited remotely without authentication. The flaw stems from improper input validation in specific HTTP requests, and Cisco said successful exploitation could let an attacker write files to the underlying operating system and later escalate privileges to **root**. Cisco assigned the issue a **Critical** security impact rating even though the CVSS v3.1 profile is listed as High severity. The vulnerability affects **Release 14** versions prior to **14SU6** and **Release 15** versions prior to **15SU5** or the relevant **COP** update. Cisco noted that exploitation requires the **WebDialer** service to be enabled, and that service is disabled by default, but Canadian authorities warned that **proof-of-concept exploit code is available** and urged organizations to review Cisco’s advisory and apply updates promptly.
Jun 29, 2026
Cisco disclosed a broad set of security flaws across enterprise products, including critical unauthenticated remote code execution, arbitrary command execution, and authentication bypass vulnerabilities affecting **Smart Software Manager On-Prem**, **Integrated Management Controller**, **Nexus Dashboard Fabric Controller**, and **Secure Firewall Management Center**. Additional high- and medium-severity issues impact **IOS XE** and other Cisco platforms, enabling denial of service, privilege escalation, arbitrary file write, server-side request forgery, secure boot bypass, sensitive information exposure, and cross-site scripting. Many of the vulnerabilities affect web-based management interfaces and network-facing services, raising the risk to remotely reachable administrative systems. One of the most severe issues, **`CVE-2026-20223`**, affects **Cisco Secure Workload** and allows an unauthenticated attacker to bypass REST API authentication and perform administrative actions. The flaw, tracked as **CWE-306** and rated **CVSS 10.0**, can expose configuration data, alter microsegmentation policies, and enable cross-tenant access with Site Admin-level impact in both SaaS and on-premises deployments. Cisco said no workaround is available and released fixes in versions **3.10.8.3** and **4.0.3.17**; reporting cited no known active exploitation or public proof-of-concept at the time.
Jul 14, 2026