Cisco Patches Zero-Day RCE Exploited by China-Linked APT in Secure Email Gateways

Cisco has issued security updates for Cisco AsyncOS Software and Cisco Secure Email and Web Manager after confirming that a zero‑day remote code execution flaw was exploited by a China‑nexus APT actor codenamed UAT‑9686. The vulnerability, tracked as CVE‑2025‑20393 with a CVSS score of 10.0, arises from insufficient validation of HTTP requests by the Spam Quarantine feature and could allow an attacker to run arbitrary commands with root privileges on affected appliances.

Exploitation required three conditions: a vulnerable Cisco AsyncOS release, the Spam Quarantine feature enabled, and the feature exposed to the internet. Cisco disclosed that, as late as November 2025, UAT‑9686 dropped tools such as ReverseSSH (AquaTunnel), Chisel and AquaPurge, and deployed a lightweight backdoor named AquaShell during campaigns.

The patches address these components by updating Cisco Email Security Gateway releases (including 14.2 and earlier up to 16.0) and Secure Email and Web Manager releases (up to 16.0), and Cisco urges customers to follow hardening guidelines to block unauthorised access on unsecured networks.

According to Cisco Security Advisory, organisations should disable HTTP for the main administrator portal, secure appliances behind a firewall, monitor web logs for unusual traffic, enforce strong authentication and change default credentials to reduce exposure.