Critical Cisco UCCX flaw lets attackers run commands as root

Cisco released patches for critical vulnerabilities in Unified Contact Center Express—most notably CVE-2025-20354, an unauthenticated Java RMI flaw enabling arbitrary command execution as root—and an authentication-bypass in the CCX Editor that can create and run admin scripts; Cisco published fixed release versions and urges administrators to upgrade immediately. The advisory also highlights a high-severity Cisco ISE DoS issue (CVE-2025-20343) and other Contact Center product flaws, while noting PSIRT has not observed public exploit code or confirmed in-the-wild exploitation for these specific issues.