CVE-2025-20358 is a critical (9.4) authentication bypass in the Contact Center Express Editor of Cisco Unified CCX. An unauthenticated remote attacker could gain administrative rights over script creation and execution. Cisco has released fixed software and offers no workaround, so upgrade to a fixed release.
What's affected
Cisco's advisory, first published 5 November 2025, covers Cisco Unified Contact Center Express, regardless of device configuration. It describes multiple vulnerabilities in the Java Remote Method Invocation process, and this CVE is one of them. The cause is improper authentication in the communication between the CCX Editor and the server. The weakness is CWE-306, missing authentication for a critical function. The CVSS vector in the record gives a 9.4 score.
The record's description says an attacker could redirect the authentication flow to a malicious server and trick the CCX Editor into believing authentication succeeded. A successful exploit could let the attacker create and execute arbitrary scripts on the underlying operating system as an internal non-root user account.
Cisco lists Packaged Contact Center Enterprise and Unified Contact Center Enterprise as not affected. Cisco says its Product Security Incident Response Team is not aware of public announcements or malicious use. The record is not on the CISA Known Exploited Vulnerabilities list.
Fixed versions: from the advisory table, release 12.5 SU3 and earlier should move to 12.5 SU3 ES07, and release 15.0 should move to 15.0 ES01.
How to check if you're exposed
Cisco says the vulnerabilities affect Unified CCX regardless of configuration, so the question is only which release you run.
- Find every Unified CCX server and note the release and the engineering special level installed.
- Compare it with the table above. Release 12.5 SU3 or earlier without ES07, and release 15.0 without ES01, need action.
- Check which networks can reach the servers and which people use the CCX Editor. Reachability tells you who could attempt the attack.
If you are unsure of the release, check the version information in the Cisco Unified CCX Administration pages or ask your Cisco partner or TAC.
What to do now
- Inventory all Unified CCX servers.
- Plan the upgrade to 12.5 SU3 ES07 or 15.0 ES01, as the advisory directs. Contact center changes need a maintenance window, so schedule it now.
- There are no workarounds. In the meantime, limit which hosts can connect to the servers to the agents and administrators who must use them.
- Review which accounts can create and run scripts, and remove ones that are not needed.
- Check the servers and logs for scripts or changes you did not make.
- Note that the advisory covers more than one vulnerability. Applying the fixed release addresses all of them.
- Subscribe to Cisco security notifications for the product line.
The network and account steps are general hardening. They are not part of the Cisco advisory.
Why it matters
The description is a trust error. The editor asks a server to confirm the user is who they claim, and the check can be steered to a server controlled by someone else. When a client accepts the answer from whatever server it is pointed to, the authentication tells you nothing.
The reward is the ability to create and run scripts on the server. Contact center scripts control how calls are routed and handled, and they run on the platform's operating system. That makes administrative control over scripts a serious position, even when the process runs as a non-root account.
Quick check
Is there a workaround?
No. Cisco says there are no workarounds for these vulnerabilities. Upgrade to the fixed release, and restrict network access to the servers while you prepare.
Do I need to patch if I use Packaged CCE or Unified CCE?
Cisco lists those products as not affected by these vulnerabilities. Unified CCX is the affected product. Check which one you run, because the names are close.
Sources
Last reviewed: 19 October 2026.
