Cisco has seriously accelerated rolling out security patches in response to critical vulnerabilities. These vulnerabilities affect its Identity Services Engine (ISE) and Unified Contact Center Express (CCX). These vulnerabilities, all rated with maximum severity ratings, potentially enable remote attackers to exploit vulnerable devices. Cisco urges all users to patch these vulnerabilities as soon as possible to ensure they have the best possible protection.
The worst of these vulnerabilities, CVE-2025-20354, has been given a critical CVSS score of 9.8. Unfortunately, this vulnerability lies within the Java Remote Method Invocation (RMI) process of Unified CCX. This vulnerability allows attackers to upload arbitrary files to the server and execute commands with root privileges on impacted systems.
CVE-2025-20358 is rated CVSS 9.4. This poses a very real danger to Unified CCX’s CCX Editor application. Unfortunately, this vulnerability allows attackers to bypass authentication, giving them administrative permissions. Once they have this access, they’re able to develop and run whatever scripts they want on the OS underneath.
High-Severity DoS Bug in Cisco’s ISE
The other a CVE-2025-20343 – which has a CVSS score of 8.6 – is impacting the Identity Services Engine (ISE). This denial-of-service (DoS) bug could allow an unauthenticated, remote attacker to make a vulnerable device restart unexpectedly. Cisco stepped up to the plate on this one, saying that
“This vulnerability is due to a logic error when processing a RADIUS access request for a MAC address that is already a rejected endpoint.” – Cisco
The firm has released patches for all of these vulnerabilities, urging users to install them as soon as possible.
No Evidence of Exploitation
Cisco previously admitted that these weaknesses are critical. Yet, they cautioned, today there’s no proof that any of the vulnerabilities have been actively exploited in the wild. Meta credited security researcher Jahmel Harris for finding and responsibly disclosing these vulnerabilities. This nomination underscores the importance of collaboration to a robust cybersecurity landscape.
Importance of Prompt Updates
With an ever-changing cyber threat landscape, it’s critical that organizations leveraging Cisco’s robust product line get in the habit of keeping their software up-to-date. The corporation encourages its community to install patches as soon as they are released. This is a positive step that will begin to lower the risks these vulnerabilities pose. Given the growing complexity of cyberattacks, it is mission-critical that systems are defended against known exploits.