Cisco Unified Contact Center Enterprise vulnerabilities

14 CVEs affecting Cisco Unified Contact Center Enterprise, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-20242, published 2025-05-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability, published 2021-12-10. Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2021-12-10. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker…
CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability, published 2023-10-10. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2023-10-10. EPSS: 100% chance of exploitation in the next 30 days. The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2025-20242, published 2025-05-21. Critical severity, CVSS 9.1. EPSS: 5.9% chance of exploitation in the next 30 days. A vulnerability in the Cloud Connect component of Cisco Unified Contact Center Enterprise (CCE) could allow an unauthenticated, remote attacker to read and modify data on an affected device. This…
CVE-2014-3323, published 2014-07-18. Medium severity, CVSS 4.0. EPSS: 2.3% chance of exploitation in the next 30 days. Directory traversal vulnerability in Cisco Unified Contact Center Enterprise allows remote authenticated users to read arbitrary web-root files via a crafted URL, aka Bug ID CSCun25262.
CVE-2017-6626, published 2017-05-03. Medium severity, CVSS 5.3. EPSS: 2.3% chance of exploitation in the next 30 days. A vulnerability in the Cisco Finesse Notification Service for Cisco Unified Contact Center Enterprise (UCCE) 11.5(1) and 11.6(1) could allow an unauthenticated, remote attacker to retrieve…
CVE-2007-5539, published 2007-10-18. High severity, CVSS 9.0. EPSS: 2.1% chance of exploitation in the next 30 days. Unspecified vulnerability in Cisco Unified Intelligent Contact Management Enterprise (ICME), Unified ICM Hosted (ICMH), Unified Contact Center Enterprise (UCCE), Unified Contact Center Hosted (UCCH),…
CVE-2007-0198, published 2007-01-11. Medium severity, CVSS 5.0. EPSS: 1.7% chance of exploitation in the next 30 days. The JTapi Gateway process in Cisco Unified Contact Center Enterprise, Unified Contact Center Hosted, IP Contact Center Enterprise, and Cisco IP Contact Center Hosted 5.0 through 7.1 allows remote…
CVE-2020-3163, published 2020-02-19. Medium severity, CVSS 5.9. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability in the Live Data server of Cisco Unified Contact Center Enterprise could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.…
CVE-2021-1395, published 2021-06-16. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a…
CVE-2016-1439, published 2016-06-23. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the management interface in Cisco Unified Contact Center Enterprise through 10.5(2) allows remote attackers to inject arbitrary web script or HTML via a…

Latest

CVE-2023-20062, published 2023-03-03. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. Multiple vulnerabilities in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to collect sensitive information or perform a server-side request forgery (SSRF) attack on…
CVE-2023-20061, published 2023-03-03. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Multiple vulnerabilities in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to collect sensitive information or perform a server-side request forgery (SSRF) attack on…
CVE-2023-20058, published 2023-01-20. Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack…