Cisco Unified CCX RCE vulnerabilities under active exploitation
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Cisco Unified CCX versions 12.5 SU3 and earlier contain unauthenticated RCE flaws being actively exploited in the wild.
The Cisco Product Security Incident Response Team has confirmed active exploitation attempts against CVE-2025-20354 and CVE-2025-20358 in Cisco Unified Contact Center Express. CVE-2025-20354 is an improper authentication flaw in the Java RMI process that allows an unauthenticated remote attacker to upload arbitrary files and execute commands with root privileges by crafting a malicious file. CVE-2025-20358 is an authentication bypass in the CCX Editor that permits an attacker to redirect authentication to a malicious server and execute arbitrary scripts with elevated internal privileges. Successful exploitation of either vulnerability could lead to complete compromise of the affected Unified CCX system. Affected versions are 12.5 SU3 and earlier. Organizations must apply Cisco-provided patches immediately and implement network segmentation to isolate contact center infrastructure, particularly for systems accessible from the internet.
Mentioned in this report
Detection guidance
Java Process Spawning Shell With Download or Reverse-Shell Commands on Linux
Java parent process (such as the Cisco UCCX RMI service) spawning a shell that downloads, stages or executes payloads, consistent with post-exploitation RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Java Process Spawning Shell With Download or Reverse-Shell Commands on Linux
description: Detects a Java process spawning sh/bash with command lines that download
payloads, change file permissions for execution, or open reverse shells. This is
typical of post-exploitation after RCE in a Java-based public-facing service, for
example the Cisco Unified CCX RMI flaw CVE-2025-20354. Matches the parent/child
relation and command patterns, not specific hosts or filenames.
status: experimental
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith: /java
Image|endswith:
- /sh
- /bash
selection_cmd:
CommandLine|contains:
- 'curl '
- 'wget '
- chmod +x
- chmod 777
- /dev/tcp/
- nc -e
- base64 -d
- python -c
- perl -e
condition: selection_parent and selection_cmd
falsepositives:
- Java-based installers or update agents that shell out to curl or wget to fetch packages
- Build or CI servers (Jenkins, Tomcat-hosted tooling) running scripted download steps
level: high
id: cfce7ea9-1057-54fc-8d05-00ba77be9b91
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-cisco-products-could-allow-for-remote-code-execution_2025-101
Java Service Spawning Reconnaissance Commands on Linux
Java parent process spawning identity or system discovery binaries, a common first step after exploiting a Java RMI or web-facing flaw to gain command execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Java Service Spawning Reconnaissance Commands on Linux
description: Detects a Java process directly spawning identity and system discovery
utilities such as whoami, id, uname or ifconfig. Attackers often run these as a
first check after gaining RCE through an exploited Java service, for example Cisco
Unified CCX. Best applied to hosts where Java is a network-exposed service and not
expected to run such commands.
status: experimental
tags:
- attack.initial-access
- attack.t1190
- attack.discovery
- attack.t1033
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith: /java
Image|endswith:
- /whoami
- /id
- /uname
- /ifconfig
- /hostname
condition: selection
falsepositives:
- Java-based monitoring or inventory agents that periodically call uname or hostname
- Application startup scripts that check the host identity
level: medium
id: a7510fcc-c722-54a1-bf6a-f6eae82f1ab1
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-cisco-products-could-allow-for-remote-code-execution_2025-101
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-cisco-products-could-allow-for-remote-code-execution_2025-101
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs