What Cisco Confirmed
Cisco has acknowledged an actively exploited zero‑day vulnerability (CVE‑2025‑20393) affecting its Secure Email products — specifically:
- Cisco Secure Email Gateway
- Cisco Secure Email and Web Manager
These products run Cisco AsyncOS software, and the flaw is unpatched and being exploited in the wild, meaning attackers are using it before a fix is available. (The Hacker News)
Severity:
- Rated 10/10 (critical) on the CVSS scale. (Forbes)
Exploitation confirmed:
- Cisco observed the attacks and began responding on 10 December 2025.
- Evidence suggests exploitation has been underway since late November 2025. (TechRadar)
What the Vulnerability Does
CVE‑2025‑20393 is a critical improper input validation flaw in AsyncOS that allows:
- Unauthenticated remote attackers to execute arbitrary system commands
- Gain full root‑level control of the appliance
- Deploy persistence mechanisms (backdoors)
The flaw affects both physical and virtual instances of the products, if configured with the Spam Quarantine feature enabled and reachable from the internet. (Censys)
Once attackers gain access, they can:
- Install backdoors for long‑term access (e.g., a Python‑based backdoor)
- Set up secret remote tunnels
- Purge or tamper with logs to hide activity
- Pivot deeper into enterprise networks
These kinds of attacks turn a security appliance — meant to protect organisations — into a trusted gateway for attackers. (Greenbone)
Who’s Behind the Exploits
Cisco’s Talos threat research team has linked the activity with moderate confidence to a China‑linked advanced persistent threat (APT) group, tracked as UAT‑9686. This group appears to share techniques and tooling with other known Chinese‑nexus threat actors. (Security Affairs)
Observed malicious tooling includes:
- AquaShell – a Python‑based backdoor
- AquaTunnel – reverse SSH tunnelling
- AquaPurge – log‑clearing utility
- Chisel – tunnelling/proxy tool
(these components support persistence and stealth access) (Greenbone)
Why This Is Serious
Email Security as a High‑Value Target
Secure Email Gateways are central to how organisations filter, inspect, and protect email traffic. If attackers can compromise these appliances, they can:
- Monitor or modify incoming/outgoing messages
- Steal credentials and sensitive data
- Move laterally within the organisation’s network
Industry analysts stress that control of email infrastructure grants broad visibility into communications and trusted access paths, making this more dangerous than entry through a peripheral service. (Network World)
What Cisco and Security Experts Are Advising
As of mid‑December 2025, no official patch is available from Cisco. Cisco’s current guidance and recommended mitigation steps include:
Immediate Actions
- Disable or remove internet exposure of management and Spam Quarantine interfaces
- Restrict appliance access using firewalls and trusted IP whitelists
- Segment and harden networks to limit exposure
- Monitor logs and indicators of compromise (IoCs) closely
- Contact Cisco Technical Assistance Center (TAC) if compromise is suspected
Cisco has indicated that in confirmed compromise cases, the only reliable way to remove persistence may be to wipe and rebuild affected appliances from a clean image. (Censys)
Known Exploited Vulnerability (KEV) Listing
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE‑2025‑20393 to its Known Exploited Vulnerabilities Catalog, highlighting active exploitation and urgent need for mitigation. (SANS Institute)
Industry and Community Reactions
Security analysts point out that the absence of a patch elevates operational risk for organisations using Cisco’s email security stack. Because bad actors are already exploiting the flaw, patch timing, network hardening, and rebuild strategies become critical decisions. (redlegg.com)
Infrastructure teams and MSP communities on technical forums emphasise:
- The critical nature of root‑level command execution without authentication
- The persistent nature of installed malware and tunnelling tools
- The need for speedy investigation, detection, and isolation of affected systems while waiting for a vendor fix (because cleanup is non‑trivial) (Reddit)
Summary of Key Points
| Aspect | Details |
|---|---|
| Vulnerability | CVE‑2025‑20393 (AsyncOS input validation flaw) |
| Severity | CVSS 10.0 (Critical) |
| Products affected | Cisco Secure Email Gateway & Secure Email and Web Manager |
| Exploit status | Confirmed active exploitation in the wild |
| Threat actors | China‑linked APT group UAT‑9686 |
| Patch availability | None yet |
| Mitigation | Network hardening, restrict internet exposure, disable features, rebuild compromised systems |
| Risk | Full system takeover, persistent backdoors, lateral network access |
What to do now:
Organisations using Cisco Secure Email products should:
- Identify exposed appliances and immediately reduce internet exposure.
- Apply access controls and segmentation.
- Monitor for IOC and unusual activity.
- Prepare for rebuild if compromise is confirmed.
Here’s a case‑study–centred breakdown with expert comments on the active zero‑day exploit Cisco has confirmed that’s targeting its Secure Email products — including how the attacks work, real exploitation examples, and reactions from security professionals and organisations:
What Is Happening — Active Zero‑Day Exploitation
The vulnerability
Cisco has confirmed that a critical, unpatched zero‑day vulnerability (CVE‑2025‑20393) in its AsyncOS software is being actively exploited in the wild. This affects:
- Cisco Secure Email Gateway (SEG) (formerly Email Security Appliance)
- Cisco Secure Email and Web Manager (SEWM)
The flaw has a CVSS score of 10.0 (critical) and allows attackers to execute arbitrary commands remotely with root privileges on affected devices if certain conditions are met. (The Hacker News)
Case Study 1 — Targeting Email Security Appliances in the Wild
How attackers exploit the flaw
The exploit targets systems where the Spam Quarantine feature is enabled and reachable from the internet — a configuration that isn’t enabled by default but may be present in some deployments. If both conditions are true, an unauthenticated attacker can:
- Execute system‑level commands with root access
- Install persistent backdoors and tunnelling mechanisms
- Pivot within networks using the compromised gateway as a trusted foothold
Observed malicious tools include:
- AquaShell — Python‑based backdoor
- AquaTunnel — SSH reverse tunnel backdoor
- AquaPurge — log‑clearing utility
- Chisel — generic tunnelling/proxy tool
These tools give attackers deep control of the device and persistence long after initial compromise. (The Hacker News)
Exploit timeline
Cisco began seeing exploitation activity around 10 December 2025, and evidence indicates attackers were active since at least late November 2025 before the public alert. (The Hacker News)
Case Study 2 — Attribution to a China‑Linked APT Group
Cisco’s Talos threat intelligence team assesses with moderate confidence that a China‑nexus advanced persistent threat (APT) group, tracked as UAT‑9686, is behind the exploitation activity. This assessment is based on overlapping tactics, tooling, and infrastructure with previously observed Chinese‑linked operations. (ccn-cert.cni.es)
Attack pattern example:
- Initial access: exploit CVE‑2025‑20393 when Spam Quarantine is exposed
- Persistence: install AquaShell backdoor
- Stealth: use AquaPurge to erase logs
- Lateral extension: establish tunnels using AquaTunnel
This pattern mirrors techniques used by other well‑known Chinese APT groups (e.g., APT41) in separate campaigns targeting VPNs, firewalls, and other infrastructure products. (ccn-cert.cni.es)
Case Study 3 — Cisco Response and Mitigation Guidance
Vendor status
- No patch is yet available from Cisco at the time of the advisory, leaving systems vulnerable if left misconfigured or exposed. (Censys)
- Cisco is actively investigating the campaign and working on a permanent fix, but remediation advice currently focuses on mitigation and containment rather than repair.
Mitigation steps recommended
Security practitioners and Cisco’s advisory recommend that organisations:
- Ensure Spam Quarantine isn’t exposed to the internet (e.g., be behind a firewall or VPN). (SANS Institute)
- Disable the Spam Quarantine feature if feasible, or at least limit access to trusted internal networks. (SANS Institute)
- Segment management interfaces and restrict access to known IPs only. (SANS Institute)
- Monitor logs and network activity closely for signs of unusual commands or traffic. (SANS Institute)
- If compromise is suspected, a full rebuild of the appliance may be required to remove implanted persistence mechanisms. (Censys)
Comments & Reactions from Experts and the Security Community
Security researchers
- Analysts emphasize that email security appliances sit at a critical trust boundary — they inspect trusted email traffic and are often allowed deep network access. If attackers own them, they can potentially intercept internal communications or broaden compromise. (Network World)
- Without a patch, many professionals cautioned organisations to assume compromise if Internet exposure occurred, even for a short time, because backdoors and tunnelling tools are designed for persistence. (Reddit)
Industry perspectives
- One security commentator pointed out that rebuilding an appliance is disruptive but sometimes necessary: a compromised security gateway can’t simply be “cleaned in place” because attackers may have deeply embedded their tools. (Network World)
Risk community consensus
- Both security ops forums and professional threads noted:
- Active exploitation is confirmed — not just theoretical or potential. (Reddit)
- No quick patch is available yet, increasing urgency for mitigation. (Reddit)
- The vulnerability has been added to CISA’s Known Exploited Vulnerabilities catalog, meaning US federal agencies have legal pressure to act quickly. (TechRadar)
What Makes This Exploit Particularly Dangerous
| Characteristic | Why It Matters |
|---|---|
| Criticality (CVSS 10.0) | Allows root‑level execution without authentication. (The Hacker News) |
| Active exploitation in the wild | Not a theoretical risk — organisations are being hit right now. (TechRadar) |
| Security appliance target | Email gateways are trusted infrastructure — compromise opens deep network access. (Network World) |
| No patch yet | Mitigation is complex and relies on configuration changes. (Censys) |
| APT attribution | Tied to China‑nexus APT group UAT‑9686, indicating sophisticated, persistent threat operations. (ccn-cert.cni.es) |
Summary
- Cisco has confirmed that an unpatched zero‑day vulnerability (CVE‑2025‑20393) in its Secure Email products is actively being exploited in attacks. (TechRadar)
- The attack enables unauthenticated root‑level command execution and persistent backdoors, primarily when the Spam Quarantine feature is exposed to the internet. (The Hacker News)
- Attackers tracked as UAT‑9686 — linked to a China‑nexus threat ecosystem — are implicated in these campaigns. (ccn-cert.cni.es)
- No patch yet — organisations are urged to harden, isolate, and potentially rebuild compromised devices. (Censys)
- Industry reaction stresses urgency due to exploit activity, trust boundary implications, and the absence of a fix. (Network World)