China-linked APT UAT-9686 abused now patched maximum severity AsyncOS bug

Cisco has fixed a maximum severity AsyncOS flaw in Secure Email products, tracked as CVE-2025-20393 (CVSS 10.0), after it was previously exploited as a zero-day by a China-linked APT group UAT-9686. The vulnerability, arising from insufficient validation of HTTP requests in the Spam Quarantine feature, allowed attackers to execute arbitrary root-level commands on affected appliances such as Secure Email Gateway and Secure Email and Web Manager.

Cisco confirmed that attacks targeted appliances with certain ports exposed to the internet and deployed a persistence mechanism to maintain control, including a Python-based backdoor named AquaShell and tools for reverse tunnelling and log deletion. According to Cisco Talos, the activity was ongoing since at least late November 2025, with December 10 marking when Cisco PSIRT first became aware of the campaign.

The advisory notes that only appliances with non-standard configurations outlined by Cisco were compromised, while Secure Email Cloud and Secure Web products were not affected. Cisco also listed the impacted releases and first fixed versions for both Cisco AsyncOS Software Release and Secure Email and Web Manager.