Cisco Unified Contact Center Express Editor Remote Code Execution Vulnerability

TL;DR 📌

• A vulnerability in the file opening process of Cisco Unified Contact Center Express (Unified CCX) Editor could allow an unauthenticated attacker to execute arbitrary code on an affected device. This vulnerability is due to insecure deserialization of Java objects by the affected software. An attacker could exploit this vulnerability by persuading an authenticated, local user to open a crafted .aef…
• No fixed release listed yet; apply mitigations and monitor.
• Workarounds are documented in the advisory.
• CVEs: CVE-2025-20275.

What happened 🕵️‍♂️

A vulnerability in the file opening process of Cisco Unified Contact Center Express (Unified CCX) Editor could allow an unauthenticated attacker to execute arbitrary code on an affected device.

This vulnerability is due to insecure deserialization of Java objects by the affected software. An attacker could exploit this vulnerability by persuading an authenticated, local user to open a crafted .aef file. A successful exploit could allow the attacker to execute arbitrary code on the host that is running the editor application with the privileges of the user who launched it.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Affected products 🖥️

At the time of publication, this vulnerability affected Cisco Unified CCX Editor.

For information about which Cisco software releases were vulnerable at the time of publication, see the Fixed Software ["#fs"] section of this advisory. See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information.

Fixed software 🔧

Upgrade to the first fixed release in your train (or later):

Workarounds 🧯

There are no workarounds that address this vulnerability.

Risk in context 🎯

Use vendor CVSS for prioritization. Consider exposure and asset criticality.

Fast facts ⚡

• Advisory: cisco-sa-uccx-editor-rce-ezyYZte8
• Initial release: 2025-06-04T16:00:00 UTC
• Last updated: 2025-06-04T16:00:00 UTC

For leadership 🧭

Executive summary. A flaw in how the Unified CCX Editor deserialises Java objects when opening .aef scripts means a crafted file can trigger code execution on the workstation of whoever opens it, with that user’s own privileges. There is no workaround, so this needs to move onto the patching schedule for the next change window rather than being left open-ended.

Why it matters:

• The bug sits in the Unified CCX Editor’s file-opening logic, so exploitation requires only that a local, authenticated user open a malicious .aef script – no network exploitation of the CCX server itself is needed.
• Because it’s insecure Java deserialization, a crafted .aef can drive arbitrary code execution on the editor host rather than just crashing the application.
• Any code that runs inherits the privileges of the person who launched the editor, so an administrator opening the wrong script could hand over admin-level control of their own workstation.
• Cisco has not published a workaround for this issue, so affected editor installations remain exposed to malicious .aef files until they are patched.

Now / Next / Later:

• Now: Identify who has the Unified CCX Editor installed and remind them not to open .aef script files from outside your organisation or unverified sources until patched.
• Next: Upgrade Unified CCX Editor installations on the 15.0 train to 15.0(1) or later in your next scheduled change window.
• Later: Establish a review or provenance-checking process for .aef scripts before they are opened, and track editor installations separately so future Cisco security advisories affecting client-side tools can be actioned quickly.