Cisco Warns of Active Attacks Exploiting Unpatched 0-Day in AsyncOS Email Security Appliances
Summary: Cisco disclosed an unpatched maximum-severity flaw, CVE-2025-20393 with a CVSS score of 10.0, in AsyncOS software affecting all releases of Cisco Secure Email Gateway and Secure Email and Web Manager, which a China-nexus APT actor codenamed UAT-9686 has actively exploited since at least late November 2025. Cisco learned of the campaign on December 10, 2025, said exploitation requires certain ports open to the internet and the Spam Quarantine feature enabled, and reported that the actor achieved root-level command execution and planted a persistence mechanism, deploying tools including ReverseSSH, Chisel, AquaPurge, and a Python backdoor called AquaShell.
Bottom line: Cisco states that rebuilding the appliance is currently the only viable way to remove the actor's persistence mechanism, so a confirmed compromise means replacement, not cleanup. CISA's KEV listing sets a December 24, 2025 mitigation deadline for federal civilian agencies, and Censys counts 220 internet-exposed Cisco Secure Email Gateway instances in the wild.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2025-20393
- Related
- CVE-2025-20393: Cisco Multiple Products Improper Input Validation Vulnerability Known Exploited Vulnerabilities · Dec 17, 2025