CVE-2018-15381

9.8 criticalEPSS 87%

Critical (9.8) in cisco unity express. EPSS 87% chance of exploitation in the next 30 days.

A Java deserialization vulnerability in Cisco Unity Express (CUE) could allow an unauthenticated, remote attacker to execute arbitrary shell commands with the privileges of the root user. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a malicious serialized Java object to the listening Java Remote Method Invocation (RMI) service. A successful exploit could allow the attacker to execute arbitrary commands on the device with root privileges.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 87% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE: CWE-502
Published: 2018-11-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

cisco:unity_express

References

Check your stack JSON