Cisco Unified Contact Center Express vulnerabilities

48 CVEs affecting Cisco Unified Contact Center Express, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-20117, published 2026-03-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability, published 2021-12-10. Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2021-12-10. EPSS: 100% chance of exploitation in the next 30 days. Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker…
CVE-2020-3280, published 2020-05-22. Critical severity, CVSS 9.8. EPSS: 7.1% chance of exploitation in the next 30 days. A vulnerability in the Java Remote Management Interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to execute arbitrary code on an affected…
CVE-2017-12337, published 2017-11-16. Critical severity, CVSS 9.8. EPSS: 6.4% chance of exploitation in the next 30 days. A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Operating System software platform could allow an unauthenticated, remote attacker to gain…
CVE-2019-1888, published 2020-09-23. High severity, CVSS 7.2. EPSS: 3.4% chance of exploitation in the next 30 days. A vulnerability in the Administration Web Interface of Cisco Unified Contact Center Express (Unified CCX) could allow an authenticated, remote attacker to upload arbitrary files and execute commands…
CVE-2010-1571, published 2010-06-10. High severity, CVSS 7.8. EPSS: 2.9% chance of exploitation in the next 30 days. Directory traversal vulnerability in the bootstrap service in Cisco Unified Contact Center Express (UCCX) 7.0 before 7.0(1)SR4 and 7.0(2), unspecified 6.0 versions, and 5.0 before 5.0(2)SR3 allows…
CVE-2020-3177, published 2020-04-15. High severity, CVSS 7.5. EPSS: 2.8% chance of exploitation in the next 30 days. A vulnerability in the Tool for Auto-Registered Phones Support (TAPS) of Cisco Unified Communications Manager (UCM) and Cisco Unified Communications Manager Session Management Edition (SME) could…
CVE-2018-0403, published 2018-07-18. Critical severity, CVSS 9.8. EPSS: 2.6% chance of exploitation in the next 30 days. Multiple vulnerabilities in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to retrieve a cleartext password.…
CVE-2010-1570, published 2010-06-10. High severity, CVSS 7.8. EPSS: 2.5% chance of exploitation in the next 30 days. The computer telephony integration (CTI) server component in Cisco Unified Contact Center Express (UCCX) 7.0 before 7.0(1)SR4 and 7.0(2), 6.0 before 6.0(1)SR1, and 5.0 before 5.0(2)SR3 allows remote…
CVE-2024-20253, published 2024-01-26. Critical severity, CVSS 10.0. EPSS: 2.4% chance of exploitation in the next 30 days. A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. This…
CVE-2011-2583, published 2012-05-02. Medium severity, CVSS 5.0. EPSS: 2.3% chance of exploitation in the next 30 days. Cisco Unified Contact Center Express (aka CCX) 8.0 and 8.5 allows remote attackers to cause a denial of service via network traffic, as demonstrated by an SEC-BE-STABLE test case, aka Bug ID…

Latest

CVE-2026-20117, published 2026-03-11. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS)…
CVE-2025-20376, published 2025-11-05. High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute arbitrary files. This vulnerability is due to an insufficient input…
CVE-2025-20375, published 2025-11-05. High severity, CVSS 7.2. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute arbitrary files. This vulnerability is due to an insufficient input…
CVE-2025-20374, published 2025-11-05. Medium severity, CVSS 4.9. EPSS: 1.1% chance of exploitation in the next 30 days. A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to perform a directory traversal and access arbitrary resources. This vulnerability is due to an…
CVE-2025-20358, published 2025-11-05. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability in the Contact Center Express (CCX) Editor application of Cisco Unified CCX could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative…
CVE-2025-20354, published 2025-11-05. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability in the Java Remote Method Invocation (RMI) process of Cisco Unified CCX could allow an unauthenticated, remote attacker to upload arbitrary files and execute arbitrary commands with…
CVE-2025-20288, published 2025-07-16. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a server-side request forgery (SSRF) attack…
CVE-2025-20274, published 2025-07-16. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to upload arbitrary files to an affected device. This…
CVE-2025-20279, published 2025-06-04. Medium severity, CVSS 4.8. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability in the web-based management interface of Cisco Unified CCX could allow an authenticated, remote attacker to conduct a stored XSS attack on an affected system. To exploit this…
CVE-2025-20278, published 2025-06-04. Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability in the CLI of multiple Cisco Unified Communications products could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an…