Cisco AsyncOS CVE-2025-20393 Zero-Day Exploited Against Secure Email Appliances
Cisco released fixes for a maximum-severity vulnerability in AsyncOS (tracked as CVE-2025-20393, CVSS 10.0) affecting Cisco Secure Email Gateway (SEG) and Secure Email and Web Manager (SEWM) appliances. Cisco reported the issue was exploited as a zero-day in attacks against a limited subset of internet-exposed appliances, enabling attackers to execute arbitrary commands with root privileges on the underlying operating system. The flaw was attributed to insufficient HTTP request validation in the Spam Quarantine feature, allowing crafted HTTP requests to trigger root-level command execution.
Cisco and Cisco Talos attributed the exploitation activity to UAT-9686, described as a China-linked threat group, with activity observed since at least late November 2025 and detected by Cisco on December 10. Cisco stated the intrusions included deployment of a persistence mechanism to maintain control over compromised appliances, and indicated that the released software updates both remediate the vulnerability and remove related persistence mechanisms; Cisco urged affected customers to upgrade to fixed releases per the updated advisory.
Timeline
Jan 15, 2026
Cisco Talos attributes campaign to UAT-9686 and reveals tooling
With the patch release, Cisco Talos publicly attributed the intrusions to UAT-9686 and disclosed technical details of the campaign, including the use of AquaShell, AquaTunnel, AquaPurge, and Chisel. Cisco also said its investigation had found evidence of persistence on compromised appliances.
Jan 15, 2026
Cisco releases patches for exploited AsyncOS flaw
On January 15, 2026, Cisco released software updates for affected AsyncOS versions to fix CVE-2025-20393 in Secure Email Gateway and Secure Email and Web Manager appliances. Cisco said the updates also remove installed persistence mechanisms and urged customers to upgrade to fixed releases.
Dec 17, 2025
CISA adds CVE-2025-20393 to the KEV catalog
CISA added the actively exploited Cisco AsyncOS vulnerability to its Known Exploited Vulnerabilities catalog in December 2025. Federal agencies were directed to mitigate the issue on an accelerated timeline.
Dec 17, 2025
Cisco discloses CVE-2025-20393 and publishes workarounds
On December 17, 2025, Cisco publicly disclosed the maximum-severity AsyncOS vulnerability CVE-2025-20393 and issued an advisory with mitigations while a full fix was still unavailable. The company warned that the flaw was under active exploitation as a zero-day.
Dec 10, 2025
Cisco becomes aware of active attacks on CVE-2025-20393
Cisco said it first became aware on December 10, 2025 that attackers were exploiting the AsyncOS flaw in the wild. The activity included root command execution and the installation of persistence on compromised appliances.
Nov 30, 2025
UAT-9686 begins exploiting AsyncOS zero-day
Cisco Talos assessed that the China-linked threat group UAT-9686 had been exploiting CVE-2025-20393 against a limited subset of internet-exposed Cisco Secure Email Gateway and Secure Email and Web Manager appliances since at least late November 2025. The attacks targeted systems with the Spam Quarantine feature enabled and exposed.
See the full picture in Mallory
Mallory subscribers get deeper analysis on every story, including:
Who’s affected and how
Deep-dive technical analysis
Actionable next steps for your team
IPs, domains, hashes, and more
Ask questions and take action on every story
Filter by topic, classification, timeframe
Get matching stories delivered automatically
Related Entities
Threat Actors
Organizations
Affected Products
Sources
2 more from sources like kyberturvallisuuskeskus alerts and register security
Related Stories
Critical Zero-Day Exploitation of Cisco Security Appliances
Multiple critical zero-day vulnerabilities have been exploited in Cisco security products, targeting both email security appliances and network firewalls. A China-linked APT, identified as UAT-9686, exploited a zero-day vulnerability (CVE-2025-20393) in Cisco email security appliances running AsyncOS, specifically when the Spam Quarantine feature is internet-accessible. This flaw allows attackers to gain root privileges, posing a severe risk to organizations relying on these appliances for email protection. In parallel, Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software have been targeted by a separate espionage campaign, linked to the ArcaneDoor threat actor, exploiting multiple zero-days (CVE-2025-20333, CVE-2025-20362, CVE-2025-20363) to achieve unauthenticated remote code execution and persistent access, even after system reboots or upgrades. These campaigns have prompted emergency directives from CISA and highlight the ongoing threat to perimeter network devices. Attackers have leveraged these vulnerabilities to establish persistent footholds, manipulate device memory, and potentially pivot deeper into victim networks. The vulnerabilities affecting ASA and FTD firewalls were publicly disclosed and patched, but the email security appliance zero-day remains unpatched, increasing the urgency for organizations to review their exposure and apply mitigations where possible.
1 months ago
Targeted Exploitation of Cisco Secure Email Gateway and Web Manager by UAT-9686
Cisco has confirmed that a sophisticated cyberattack campaign is actively targeting a subset of Cisco Secure Email Gateway and Cisco Secure Email and Web Manager appliances running AsyncOS Software. The attackers are exploiting a critical vulnerability, tracked as CVE-2025-20393, which allows them to execute arbitrary commands with root privileges on affected systems. Cisco's investigation has revealed that the threat actors have deployed a persistence mechanism to maintain control over compromised appliances, and there are currently no available workarounds. Customers are strongly advised to follow Cisco's mitigation guidance to assess exposure and reduce risk. Cisco Talos has attributed this campaign to a Chinese-nexus advanced persistent threat (APT) group, tracked as UAT-9686. The attackers have deployed a custom Python-based backdoor called "AquaShell," along with additional tools for reverse tunneling and log purging, such as AquaTunnel and AquaPurge. The campaign has been ongoing since at least late November 2025 and primarily affects appliances with non-standard configurations exposed to the internet. The attack highlights the importance of securing management interfaces and promptly applying vendor-recommended mitigations to prevent further compromise.
1 months ago
Cisco SD-WAN Zero-Day Exploited to Add Rogue Peers and Gain Persistent Root Access
Cisco and multiple government cyber agencies warned that attackers are actively exploiting **CVE-2026-20127**, a critical `CVSS 10.0` authentication bypass in **Cisco Catalyst SD-WAN Controller** and **Catalyst SD-WAN Manager**. The flaw affects the peering authentication process and lets unauthenticated remote attackers gain administrative access, use `NETCONF`, and alter SD-WAN fabric configuration, including adding **malicious rogue peers**. Cisco Talos attributed the activity to a sophisticated cluster tracked as **UAT-8616**, with evidence suggesting exploitation dates back to at least 2023 and has affected high-value targets, including critical infrastructure and government networks. Investigators said the intrusions often continued with a downgrade of the appliance software to exploit **CVE-2022-20775** for **root** privilege escalation, after which the original version was restored to help conceal the compromise while maintaining persistence. In response, **CISA** added both CVEs to the **Known Exploited Vulnerabilities** catalog and issued **Emergency Directive 26-03** for U.S. federal civilian agencies, while the **UK NCSC**, **ACSC**, **Canadian Centre for Cyber Security**, and other partners released joint hunting and hardening guidance. Cisco said there are **no complete workarounds**, urged immediate upgrades to fixed releases, and advised defenders to review peering events, SSH key activity, version history, and logs for signs of tampering or unauthorized access.
1 weeks ago