# Cisco Unified CCX RCE vulnerabilities under active exploitation

Published: 2026-06-09 · Severity: high · Sectors: telecommunications, government-national, financial-services
Canonical: https://vorant.io/reports/d3519e5e-b130-5bd3-9115-c6f425e384cf/cisco-unified-ccx-rce-vulnerabilities-under-active-exploitation

> Cisco Unified CCX versions 12.5 SU3 and earlier contain unauthenticated RCE flaws being actively exploited in the wild.

The Cisco Product Security Incident Response Team has confirmed active exploitation attempts against CVE-2025-20354 and CVE-2025-20358 in Cisco Unified Contact Center Express. CVE-2025-20354 is an improper authentication flaw in the Java RMI process that allows an unauthenticated remote attacker to upload arbitrary files and execute commands with root privileges by crafting a malicious file. CVE-2025-20358 is an authentication bypass in the CCX Editor that permits an attacker to redirect authentication to a malicious server and execute arbitrary scripts with elevated internal privileges. Successful exploitation of either vulnerability could lead to complete compromise of the affected Unified CCX system. Affected versions are 12.5 SU3 and earlier. Organizations must apply Cisco-provided patches immediately and implement network segmentation to isolate contact center infrastructure, particularly for systems accessible from the internet.

## Mentioned in this report

- Vulnerabilities: CVE-2025-20354, CVE-2025-20358

## Detection guidance (public sample)

### Java Process Spawning Shell With Download or Reverse-Shell Commands on Linux

ATT&CK: T1190

Java parent process (such as the Cisco UCCX RMI service) spawning a shell that downloads, stages or executes payloads, consistent with post-exploitation RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Java Process Spawning Shell With Download or Reverse-Shell Commands on Linux
description: Detects a Java process spawning sh/bash with command lines that download
  payloads, change file permissions for execution, or open reverse shells. This is
  typical of post-exploitation after RCE in a Java-based public-facing service, for
  example the Cisco Unified CCX RMI flaw CVE-2025-20354. Matches the parent/child
  relation and command patterns, not specific hosts or filenames.
status: experimental
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: /java
    Image|endswith:
    - /sh
    - /bash
  selection_cmd:
    CommandLine|contains:
    - 'curl '
    - 'wget '
    - chmod +x
    - chmod 777
    - /dev/tcp/
    - nc -e
    - base64 -d
    - python -c
    - perl -e
  condition: selection_parent and selection_cmd
falsepositives:
- Java-based installers or update agents that shell out to curl or wget to fetch packages
- Build or CI servers (Jenkins, Tomcat-hosted tooling) running scripted download steps
level: high
id: cfce7ea9-1057-54fc-8d05-00ba77be9b91
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-cisco-products-could-allow-for-remote-code-execution_2025-101
```

### Java Service Spawning Reconnaissance Commands on Linux

ATT&CK: T1190

Java parent process spawning identity or system discovery binaries, a common first step after exploiting a Java RMI or web-facing flaw to gain command execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Java Service Spawning Reconnaissance Commands on Linux
description: Detects a Java process directly spawning identity and system discovery
  utilities such as whoami, id, uname or ifconfig. Attackers often run these as a
  first check after gaining RCE through an exploited Java service, for example Cisco
  Unified CCX. Best applied to hosts where Java is a network-exposed service and not
  expected to run such commands.
status: experimental
tags:
- attack.initial-access
- attack.t1190
- attack.discovery
- attack.t1033
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: /java
    Image|endswith:
    - /whoami
    - /id
    - /uname
    - /ifconfig
    - /hostname
  condition: selection
falsepositives:
- Java-based monitoring or inventory agents that periodically call uname or hostname
- Application startup scripts that check the host identity
level: medium
id: a7510fcc-c722-54a1-bf6a-f6eae82f1ab1
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-cisco-products-could-allow-for-remote-code-execution_2025-101
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-cisco-products-could-allow-for-remote-code-execution_2025-101

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/d3519e5e-b130-5bd3-9115-c6f425e384cf/cisco-unified-ccx-rce-vulnerabilities-under-active-exploitation.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup