CVE-2025-20393: Cisco AsyncOS Zero-Day Impacts Secure Email Appliances

CVE-2025-20393 is a zero-day vulnerability in Cisco AsyncOS Software that Cisco has described as maximum-severity and is already being exploited in real-world attacks against Cisco Secure Email Gateway and Cisco Secure Email and Web Manager appliances. The flaw allows attackers to execute arbitrary commands with root-level privileges due to improper input validation, potentially removing security boundaries and enabling long-term persistence.

Not all Cisco email security deployments are equally exposed, but the advisory notes that attacks target a limited subset of appliances with exposed ports, including both physical and virtual forms of the affected products, and that all releases of Cisco AsyncOS Software are affected.

According to Cisco Talos, attribution is to a China-nexus advanced persistent threat tracked as UAT-9686, with activity active since at least late November 2025 and uncovered on 10 December 2025; tools observed include AquaShell, AquaTunnel, Chisel and AquaPurge. CISA has added CVE-2025-20393 to its Known Exploited Vulnerabilities catalog, and under Binding Operational Directive requirements, Federal Civilian Executive Branch agencies must apply mitigations by 24 December 2025.

Defenders are advised to verify Spam Quarantine configurations and exposure, audit logs for suspicious HTTP POST requests, and consider rebuilding the appliance if compromise is confirmed.