CVE-2025-20358: Cisco Unified Contact Center Express · Missing Authentication
Affects Cisco Unified Contact Center ExpressSource CVE Database V5
Not known to be exploited · CVSS 9.4 Critical.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.9% chance of exploitation in 30 days – higher than 60% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:LExploitation evidence
Disclosed: evidence found.
CVE published 5 Nov 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Cisco Cisco Unified Contact Center Express | Affected
| Fixed in– |
AI-suggested
To mitigate CVE-2025-20358, organizations should immediately apply any patches or updates released by Cisco addressing this vulnerability. In the absence of patches, network segmentation should be enforced to restrict access to the CCX Editor and Unified CCX servers, limiting exposure to trusted administrative networks only. Implement strict firewall rules to block unauthorized inbound traffic to CCX management interfaces. Employ network intrusion detection and prevention systems (IDS/IPS) to monitor and block suspicious authentication redirection attempts or anomalous script execution activities. Enable logging and continuous monitoring of CCX Editor interactions and script changes to detect potential exploitation attempts early. Consider deploying multi-factor authentication (MFA) for administrative access where possible, even though the vulnerability bypasses authentication, to add an additional security layer. Regularly audit and review contact center configurations and scripts for unauthorized modifications. Finally, conduct security awareness training for administrators to recognize and respond to suspicious activities related to CCX management.
Description
A vulnerability in the Contact Center Express (CCX) Editor application of Cisco Unified CCX could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative permissions pertaining to script creation and execution. This vulnerability is due to improper authentication mechanisms in the communication between the CCX Editor and an affected Unified CCX server. An attacker could exploit this vulnerability by redirecting the authentication flow to a malicious server and tricking the CCX Editor into believing the authentication was successful. A successful exploit could allow the attacker to create and execute arbitrary scripts on the underlying operating system of an affected Unified CCX server, as an internal non-root user account.