CVE-2025-20279: Cisco Unified Contact Center Express · Cross-site Scripting
Affects Cisco Unified Contact Center ExpressSource CVE Database V5
Not known to be exploited · CVSS 4.8 Medium.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 17% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 4 Jun 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Cisco Unified Contact Center Express | Affected
| Fixed in– |
AI-suggested
1. Immediate mitigation should focus on restricting administrative access to the Cisco Unified CCX management interface through network segmentation, VPNs, and strong multi-factor authentication to reduce the risk of credential compromise. 2. 3. Implement strict input validation and output encoding policies on the management interface where possible, including Content Security Policy (CSP) headers to mitigate the impact of XSS attacks. 4. Conduct regular audits of administrative accounts and monitor for suspicious activities or unusual login patterns to detect potential exploitation attempts early. 5. Educate administrators about the risks of stored XSS and the importance of cautious handling of input fields in the management interface. 6. Where feasible, limit the number of users with administrative privileges and enforce the principle of least privilege to minimize exposure. 7. Employ web application firewalls (WAFs) with rules tailored to detect and block XSS payloads targeting the management interface.
Description
A vulnerability in the web-based management interface of Cisco Unified CCX could allow an authenticated, remote attacker to conduct a stored XSS attack on an affected system. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to improper sanitization of user input to the web-based management interface. An attacker could exploit this vulnerability by submitting a malicious script through the interface. A successful exploit could allow the attacker to conduct a stored XSS attack on the affected system.