CVE-2025-20276: Cisco Unified Contact Center Express · Deserialization of Untrusted Data
Affects Cisco Unified Contact Center ExpressSource CVE Database V5
Not known to be exploited · CVSS 3.8 Low.
Data as of 26 Oct 2026, 06:26 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 38% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 4 Jun 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Cisco Unified Contact Center Express | Affected
| Fixed in– |
AI-suggested
To mitigate CVE-2025-20276, organizations should first verify if their Cisco Unified Contact Center Express deployments run affected versions and prioritize patching as soon as Cisco releases official updates addressing this vulnerability. In the absence of patches, administrators should restrict access to the web-based management interface to trusted networks and enforce strict network segmentation to limit exposure. Implement multi-factor authentication (MFA) for all administrative accounts to reduce the risk of credential compromise. Regularly audit and monitor administrative access logs for unusual activity indicative of exploitation attempts. Employ application-layer firewalls or intrusion prevention systems capable of detecting anomalous deserialization payloads or suspicious Java object traffic. Additionally, review and harden Java deserialization configurations if customizable, applying security controls such as object input validation or deserialization filters where possible. Conduct thorough privilege management to minimize the number of users with administrative rights and enforce the principle of least privilege. Finally, maintain an incident response plan tailored to contact center infrastructure to quickly contain and remediate any compromise stemming from this vulnerability.
Description
A vulnerability in the web-based management interface of Cisco Unified CCX could allow an authenticated, remote attacker to execute arbitrary code on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insecure deserialization of Java objects by the affected software. An attacker could exploit this vulnerability by sending a crafted Java object to an affected device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system of an affected device as a low-privilege user. A successful exploit could also allow the attacker to undertake further actions to elevate their privileges to root.