Cisco Zero-Day Siege: Chinese Group UAT-9686 Deploys ‘Aqua’ Malware via CVSS 10 Root Exploit

A critical zero-day in Cisco’s Secure Email Gateway and Secure Email and Web Manager appliances is under active siege, with attackers gaining full control over affected gateways. The flaw, tracked as CVE-2025-20393, carries a maximum CVSS score of 10 and allows authentication bypass and root command execution on the underlying operating system.

The campaign, uncovered by Cisco Talos, is attributed with moderate confidence to a Chinese-nexus threat actor tracked as UAT-9686, whose toolkit for these appliances includes the Aqua family: AquaShell, AquaPurge and AquaTunnel, designed to embed a backdoor, scrub logs and establish a reverse connection. Exploitation hinges on a misconfiguration of the Spam Quarantine feature; if enabled and exposed to the internet, it provides a direct entry point for the attackers.

Cisco says the persistence mechanism is deeply embedded, and remediation requires rebuilding the affected appliances. Administrators are urged to audit configurations and ensure Spam Quarantine is firewall-protected and isolated from public access, given the severity of a CVSS 10 vulnerability.