Cisco
Cisco Unified Contact Center Express: vulnerabilidades y CVE
Cisco Unified Contact Center Express tiene 49 vulnerabilidades publicadas, 7 de ellas en los últimos 12 meses. 8 son críticas y 1 figuran en el catálogo de explotación activa de CISA.
CVE49
Últimos 12 meses7
Críticas8
Explotadas activamente1
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
🔴 Explotadas activamente (CISA KEV)
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2021-44228 | Crítica (10) | 100% | ⚠ Explotación activa | 10 dic 2021 | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other… |
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-20117 | Media (6.1) | 0.21% | — | 11 mar 2026 | A vulnerability in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of… |
| CVE-2026-20116 | Media (6.1) | 0.21% | — | 11 mar 2026 | A vulnerability in the web-based management interface of Cisco Finesse, Cisco Packaged Contact Center Enterprise (Packaged CCE), Cisco Unified Contact Center Enterprise (Unified CCE), Cisco Unified Contact Center… |
| CVE-2025-20376 | Alta (7.2) | 0.48% | — | 5 nov 2025 | A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute arbitrary files. This vulnerability is due to an insufficient input validation associated to file… |
| CVE-2025-20375 | Alta (7.2) | 0.39% | — | 5 nov 2025 | A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute arbitrary files. This vulnerability is due to an insufficient input validation associated to… |
| CVE-2025-20374 | Media (4.9) | 1.1% | — | 5 nov 2025 | A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to perform a directory traversal and access arbitrary resources. This vulnerability is due to an insufficient input… |
| CVE-2025-20358 | Crítica (9.8) | 0.92% | — | 5 nov 2025 | A vulnerability in the Contact Center Express (CCX) Editor application of Cisco Unified CCX could allow an unauthenticated, remote attacker to bypass authentication and obtain administrative permissions pertaining to… |
| CVE-2025-20354 | Crítica (9.8) | 0.87% | — | 5 nov 2025 | A vulnerability in the Java Remote Method Invocation (RMI) process of Cisco Unified CCX could allow an unauthenticated, remote attacker to upload arbitrary files and execute arbitrary commands with root permissions on… |
| CVE-2025-20288 | Media (5.3) | 0.37% | — | 16 jul 2025 | A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a server-side request forgery (SSRF) attack through an affected… |
| CVE-2025-20274 | Alta (8.8) | 0.44% | — | 16 jul 2025 | A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to… |
| CVE-2025-20279 | Media (4.8) | 0.26% | — | 4 jun 2025 | A vulnerability in the web-based management interface of Cisco Unified CCX could allow an authenticated, remote attacker to conduct a stored XSS attack on an affected system. To exploit this vulnerability, the attacker… |
| CVE-2025-20278 | Media (6.7) | 0.18% | — | 4 jun 2025 | A vulnerability in the CLI of multiple Cisco Unified Communications products could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device as the… |
| CVE-2025-20277 | Media (6.7) | 0.17% | — | 4 jun 2025 | A vulnerability in the web-based management interface of Cisco Unified CCX could allow an authenticated, local attacker to execute arbitrary code on an affected device. To exploit this vulnerability, the attacker must… |
| CVE-2025-20276 | Alta (7.2) | 0.45% | — | 4 jun 2025 | This vulnerability is due to insecure deserialization of Java objects by the affected software. An attacker could exploit this vulnerability by sending a crafted Java object to an affected device. A successful exploit… |
| CVE-2025-20275 | Alta (7.8) | 0.19% | — | 4 jun 2025 | This vulnerability is due to insecure deserialization of Java objects by the affected software. An attacker could exploit this vulnerability by persuading an authenticated, local user to open a crafted .aef file. A… |
| CVE-2025-20129 | Media (5.4) | 0.34% | — | 4 jun 2025 | A vulnerability in the web-based chat interface of Cisco Customer Collaboration Platform (CCP), formerly Cisco SocialMiner, could allow an unauthenticated, remote attacker to persuade users to disclose sensitive data.… |
| CVE-2025-20114 | Media (4.3) | 0.35% | — | 21 may 2025 | A vulnerability in the API of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to perform a horizontal privilege escalation attack on an affected system. This vulnerability is due to… |
| CVE-2025-20113 | Alta (7.1) | 0.41% | — | 21 may 2025 | A vulnerability in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to elevate privileges to Administrator for a limited set of functions on an affected system. This vulnerability is due… |
| CVE-2024-20253 | Crítica (10) | 2.4% | — | 26 ene 2024 | A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due… |
| CVE-2023-20232 | Media (5.3) | 0.55% | — | 16 ago 2023 | A vulnerability in the Tomcat implementation for Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to cause a web cache poisoning attack on an affected device. This… |
| CVE-2023-20096 | Media (5.4) | 0.50% | — | 5 abr 2023 | A vulnerability in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an authenticated, remote attacker to perform a stored cross-site scripting (XSS) attack. This… |
| CVE-2023-20062 | Media (4.3) | 0.53% | — | 3 mar 2023 | Multiple vulnerabilities in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to collect sensitive information or perform a server-side request forgery (SSRF) attack on an affected system.… |
| CVE-2023-20061 | Media (6.5) | 0.73% | — | 3 mar 2023 | Multiple vulnerabilities in Cisco Unified Intelligence Center could allow an authenticated, remote attacker to collect sensitive information or perform a server-side request forgery (SSRF) attack on an affected system.… |
| CVE-2023-20058 | Media (6.1) | 0.49% | — | 20 ene 2023 | A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the… |
| CVE-2022-20658 | Crítica (9.6) | 1.4% | — | 14 ene 2022 | A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal (Unified CCMP) and Cisco Unified Contact Center Domain Manager (Unified CCDM) could allow an authenticated, remote… |
| CVE-2021-44228 | Crítica (10) | 100% | ⚠ Explotación activa | 10 dic 2021 | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other… |
| CVE-2021-1395 | Media (6.1) | 0.81% | — | 16 jun 2021 | A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.… |
| CVE-2021-1463 | Media (6.1) | 0.82% | — | 8 abr 2021 | A vulnerability in the web-based management interface of Cisco Unified Intelligence Center Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the… |
| CVE-2019-1888 | Alta (7.2) | 3.4% | — | 23 sept 2020 | A vulnerability in the Administration Web Interface of Cisco Unified Contact Center Express (Unified CCX) could allow an authenticated, remote attacker to upload arbitrary files and execute commands on the underlying… |
| CVE-2020-3267 | Alta (7.1) | 0.81% | — | 3 jun 2020 | A vulnerability in the API subsystem of Cisco Unified Contact Center Express (Unified CCX) could allow an authenticated, remote attacker to change the availability state of any agent. The vulnerability is due to… |
| CVE-2020-3280 | Crítica (9.8) | 6.9% | — | 22 may 2020 | A vulnerability in the Java Remote Management Interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. The… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.