CISA Alert: Chinese Hackers Weaponize CVSS 10 Cisco Zero-Day & SonicWall Exploit Chains

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent directive adding three critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, signalling active weaponisation in the wild. Topping the list is CVE-2025-20393, a zero-day in Cisco’s Secure Email Gateway and Web Manager appliances with a CVSS score of 10/10, allowing unauthenticated attackers to bypass all defenses and execute root commands via an input-validation flaw in the Spam Quarantine feature.

According to Cisco Talos, a Chinese-nexus threat group tracked as UAT-9686 is already exploiting this flaw with a suite of custom malware including the AquaShell persistent backdoor and AquaPurge, a tool designed to scrub logs and hide their tracks. CISA also flags a critical issue involving SonicWall SMA1000 appliances where attackers chain CVE-2025-23006 with a pre-authentication deserialization flaw to achieve unauthenticated remote code execution with root privileges.

The third addition concerns CVE-2025-59374 (CVSS 9.3), affecting the ASUS Live Update client via a supply chain compromise, described as a “zombie” risk on unpatched, End-of-Support software. Federal agencies have a patch deadline of 24 December 2025.