If you want to upgrade from 12.5 SU2 to SU4 you will run into the following BUG:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvt55425/?rfs=iqvred

Sadly Cisco did not (yet) include a quick workaround for this:

utils system enableAdministration

https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/cli_ref/12_5_1/cucm_b_cli-reference-guide-1251/cucm_b_cli-reference-guide-1251_chapter_01001.html#reference_0A831E3277AE6180E3E524187127D833

After this command you are abale to make changes and also AXL Third Parties are working fine again.