CVE-2018-15381: Cisco Unity Express Java deserialization allows unauthenticated root command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable deserialization leading to root command execution, with a 9.8 CVSS score and very high EPSS probability, makes this an urgent patch-or-isolate case.

What it is

Cisco Unity Express deserializes user-supplied content insecurely, allowing a remote attacker to send a malicious serialized Java object to the Java RMI service. Because the flaw is reachable without authentication and yields root-level command execution, it is a severe pre-auth remote code execution issue for exposed CUE deployments.

Impact

An attacker gains arbitrary shell command execution with root privileges on the affected device, effectively full control of the appliance.

Attack surface

Reachable over the network via the listening Java RMI service; the CVSS vector shows no privileges required and no user interaction, so any host that can reach the RMI port can attempt exploitation.

Exploitation

Not listed in CISA KEV and no public exploit tags appear in the references, but EPSS is very high (0.87254, 99.7th percentile), indicating strong predicted likelihood of exploitation activity.

What to do

• Apply the Cisco Unity Express fix from the vendor advisory cisco-sa-20181107-cue; patch is the first action.
• Restrict network access to the Java RMI service so only trusted management hosts can reach it, and block it at perimeter and inter-segment boundaries.
• If the RMI service is not required, disable it; otherwise isolate CUE systems in a dedicated management VLAN.
• Monitor Cisco advisories for updated guidance and verify the installed CUE version against the fixed release.
• Treat any internet-exposed CUE RMI endpoint as compromised until logs are reviewed.

Detection

• Alert on unexpected inbound connections to the Java RMI port on Unity Express systems, especially from non-management networks.
• Look for Java deserialization or RMI-related error and exception entries in CUE and host logs.
• Monitor for unexpected child processes or shell activity spawned by the Java/RMI service.
• Baseline normal RMI client sources and flag new or anomalous source IPs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.