Cisco Patches Vulnerability Exploited by Chinese Hackers

According to Cisco, a vulnerability in Secure Email Gateway and Secure Email and Web Manager was patched after being exploited in the wild, tracked as CVE-2025-20393 with a CVSS score of 10/10. The attack campaign, which Cisco attributes to UAT-9686, a China‑linked APT, saw the threat actors deploy the AquaShell backdoor along with AquaTunnel (ReverseSSH), the Chisel tunneling tool and AquaPurge to clear logs.

The flaw affects the Spam Quarantine feature of the AsyncOS software running on the two appliances and exists due to insufficient validation of HTTP requests, allowing unauthenticated remote command execution with root privileges. Cisco notes there are no workarounds and urges upgrading to fixed AsyncOS releases: 15.0.5-016, 15.0.5-016, 15.5.4-012, and 16.0.4-016 for Email Security Gateway, and 15.0.2-007, 15.5.4-007, and 16.0.4-010 for Email and Web Manager. The advisory update, issued on 16 January 2026, confirms the patches and the removal of persistence mechanisms identified in the campaign.