Cisco has confirmed active exploitation of a critical zero-day remote code execution vulnerability affecting Cisco Secure Email Gateway (SEG) and Secure Email and Web Manager (SEWM) appliances.
🆔 Tracked as CVE-2025-20393 (CVSS 10.0), the flaw allows unauthenticated attackers to execute arbitrary commands as root via crafted HTTP requests targeting the Spam Quarantine feature of Cisco AsyncOS.
What we know so far:
- Exploitation has been observed in the wild since November 2025
- Cisco became aware of the attacks on December 10, 2025
- The vulnerability affects systems where Spam Quarantine is enabled and internet-exposed (typically port 6025)
- The feature is not enabled by default, but exposure dramatically increases risk
Threat activity:
Cisco Talos attributes the campaign to UAT-9686 (UNC-9686), a China-linked threat actor, based on tooling overlaps with known APT groups.
Attackers deploy:
- AquaShell (Python backdoor for persistence)
- AquaTunnel / Chisel (reverse SSH tunneling for lateral movement)
- AquaPurge (log wiping to evade detection)
Targets include telecommunications and critical infrastructure, with activity primarily focused on espionage, rather than ransomware.
Response & mitigation:
- Cisco has released patched versions for all affected releases
- No workarounds exist
- Persistence mechanisms are removed as part of the patching process
- CISA has added CVE-2025-20393 to the KEV catalog, requiring rapid mitigation
✅ Additional hardening is strongly recommended:
- Restrict management interface exposure
- Separate mail and management planes
- Disable unnecessary services (HTTP/FTP)
- Use strong authentication (SAML / LDAP)
- Monitor logs externally and validate compromise status with Cisco TAC
☁️ Cisco Secure Email Cloud services are not affected.
If you operate Cisco Secure Email appliances, immediate patching and a review of exposure are critical.
