Cisco Warns of Active Attacks Exploiting Unpatched 0-Day in AsyncOS Email Security Appliances

Cisco has alerted users to a maximum-severity zero-day in Cisco AsyncOS that has been actively exploited in campaigns targeting Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. The vulnerability, tracked as CVE-2025-20393 with a CVSS score of 10.0, allows threat actors to execute arbitrary commands with root privileges on the appliance’s underlying operating system.

The intrusion campaign, observed since late November 2025, has been linked to a China-nexus APT actor codenamed UAT-9686 and involves a limited subset of appliances with certain ports exposed to the internet, according to Cisco. In its advisory, Cisco said there is evidence of a persistence mechanism planted by the threat actors to maintain control over compromised devices.

The company notes that, in the absence of a patch, users should restore secure configurations, limit internet access to the appliances, and consider rebuilding compromised systems to eradicate persistence. The U.S. CISA has added CVE-2025-20393 to its Known Exploited Vulnerabilities catalog, requiring mitigations by 24 December 2025, while GreyNoise reported a broad credential-based campaign targeting VPN portals from multiple vendors around the same period.