Loading story…
A critical vulnerability, tracked as CVE-2025-20393, has been identified in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager products running any version of AsyncOS with the Spam Quarantine feature enabled and exposed to the internet. Cisco released a security advisory detailing the flaw and urging administrators to review recommendations and apply necessary updates to mitigate the risk. The vulnerability allows for improper input validation, which could be exploited by malicious actors to compromise affected systems.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-20393 to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation. Federal agencies are required to remediate this vulnerability by the specified deadline, and CISA strongly encourages all organizations to prioritize patching to reduce exposure to cyberattacks. The inclusion of this vulnerability in the KEV Catalog highlights its significance as a frequent attack vector and underscores the urgent need for remediation across both public and private sectors.
See which actors are running it and whether you're in range.
9 events from the most recent confirmed update back to the earliest known activity.
Published on 2026-02-05, STAR Labs described CVE-2025-20393 as stemming from a single-byte integer overflow in the EUQ RPC protocol that could bypass authentication checks and feed attacker-controlled data into cPickle.loads() for unauthenticated remote code execution. The write-up also said Cisco addressed the flaw in AsyncOS 15.5.4 by rejecting source or destination length values of 255 bytes or greater.
By 2025-12-21, reporting indicated that at least 120 Cisco Secure Email Gateway and Secure Email and Web Manager devices were confirmed vulnerable and exposed while no official patch was yet available. The update showed the scale of internet-facing exposure and the continuing risk from active exploitation.
On 2025-12-19, a Python tool called 'Cisco SMA Exposure Check' was released to help organizations identify internet-exposed systems and possible indicators of compromise related to CVE-2025-20393. The script checks open ports, fingerprints HTTP/S services, and looks for artifacts associated with post-compromise tooling such as AquaShell and Chisel.
On 2025-12-18, CERT-EU issued an advisory warning that CVE-2025-20393 could allow arbitrary commands with root privileges on exposed appliances. It urged defenders to verify exposure, restrict access, and investigate for lateral movement or compromise.
By 2025-12-18, public reporting attributed exploitation of CVE-2025-20393 to a China-linked APT, identified as UAT-9686 with overlaps to UNC5174 and APT41. This represented an attribution update beyond the initial vendor disclosure of active exploitation.
Cisco's investigation, referenced in later reporting, said the attack activity was first identified through a Cisco TAC case and further analyzed by Cisco Talos. The analysis found attackers implanting persistence, disabling security tools, and establishing covert channels on compromised appliances.
On 2025-12-17, CISA added CVE-2025-20393 to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. The addition triggered remediation requirements for U.S. Federal Civilian Executive Branch agencies under Binding Operational Directive 22-01.
At disclosure, Cisco said no patch was available for CVE-2025-20393 and advised organizations to restrict or remove internet exposure of the vulnerable Spam Quarantine interface, investigate for compromise, and rebuild affected appliances if necessary. Multiple advisories noted Cisco Secure Email Cloud was not affected.
On 2025-12-17, Cisco disclosed a critical vulnerability, CVE-2025-20393, affecting Secure Email Gateway and Secure Email and Web Manager appliances running AsyncOS when the Spam Quarantine feature is enabled and exposed to the internet. The flaw allows unauthenticated remote command execution as root and was reported as actively exploited in the wild.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
11 references tracked. Mallory keeps watching after this page renders.
starlabs.sg
Open sourcestarlabs.sg
Open sourcecybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourcethecyberexpress.com
Open sourcecyber.gc.ca
Open sourcerunzero.com
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) Catalog by adding five new security flaws that are currently under active exploitation. The vulnerabilities include CVE-2021-21311 affecting Adminer, CVE-2025-20352 impacting Cisco IOS and IOS XE, CVE-2025-10035 in Fortra GoAnywhere MFT, CVE-2025-59689 in Libraesva Email Security Gateway, and CVE-2025-32463 in Sudo. The Adminer flaw is a Server-Side Request Forgery (SSRF) vulnerability that allows attackers to manipulate URL parameters, potentially enabling unauthorized access to internal resources and facilitating lateral movement within networks. The Cisco IOS and IOS XE vulnerability is a stack-based buffer overflow in the SNMP subsystem, which can be exploited by sending crafted SNMP packets, leading to denial of service or remote code execution as root, depending on attacker privileges. Fortra GoAnywhere MFT is affected by a critical deserialization vulnerability in its License Servlet, which could allow attackers to execute arbitrary code. Libraesva ESG suffers from a command injection vulnerability, and Sudo is impacted by a flaw involving the inclusion of functionality from an untrusted control sphere. CISA’s Product Security Incident Response Team (PSIRT) has confirmed that these vulnerabilities are being actively exploited in the wild. The addition of these flaws to the KEV Catalog is based on credible evidence of exploitation, and CISA has issued a Binding Operational Directive (BOD) 22-01 requiring Federal Civilian Executive Branch (FCEB) agencies to remediate these vulnerabilities by specified deadlines. The directive aims to reduce significant risk to federal networks, but CISA also strongly urges all organizations, not just federal agencies, to prioritize remediation of these vulnerabilities as part of their vulnerability management programs. The vulnerabilities span a range of critical systems, including database management tools, network operating systems, email security gateways, and managed file transfer platforms, highlighting the broad attack surface targeted by malicious actors. The Adminer SSRF vulnerability, with a CVSS score of 7.2, affects versions 4.0.0 to just before 4.7.9, while the Cisco IOS/IOS XE flaw, with a CVSS score of 7.7, impacts all devices with SNMP enabled. The Fortra GoAnywhere MFT vulnerability is rated as critical with a CVSS score of 10.0, underscoring the urgency of remediation. CISA’s ongoing updates to the KEV Catalog reflect the evolving threat landscape and the need for organizations to remain vigilant against actively exploited vulnerabilities. Organizations are encouraged to consult the KEV Catalog regularly and implement timely patches to mitigate the risk of compromise. The inclusion of these vulnerabilities in the KEV Catalog serves as a warning to both public and private sector entities about the heightened risk posed by these flaws. Failure to address these vulnerabilities could result in significant operational disruptions or unauthorized access to sensitive systems. CISA’s alert emphasizes the importance of proactive vulnerability management and cross-sector collaboration to defend against active cyber threats.
Jun 29, 2026
Cisco disclosed active exploitation of **CVE-2026-76461**, an SQL injection flaw affecting Cisco Secure Email Gateway deployments. The vulnerability affects unpatched releases of Cisco AsyncOS for Cisco Secure Email Gateway, Cisco Secure Email Gateway, and Cisco Secure Email and Web Manager. CISA added CVE-2026-76461 to its Known Exploited Vulnerabilities Catalog, while the Canadian Centre for Cyber Security issued advisory **AV26-921**. Cisco has released a September 2026 security-hardening update; administrators should identify affected appliances and management systems and apply Cisco’s prescribed fixed releases promptly.
Sep 14, 2026
CISA added **CVE-2008-4128** to its Known Exploited Vulnerabilities catalog after confirming in-the-wild exploitation of a cross-site request forgery flaw in **Cisco IOS 12.4** on **Cisco 871 Integrated Services Routers**. The vulnerability affects the HTTP Administration interface and can let a remote attacker trick an authenticated administrator into executing arbitrary commands through crafted HTTP requests and specific URIs tied to functions such as `show privilege` and `alias exec`. The KEV catalog update increased the total number of listed vulnerabilities from **1637** to **1638** and marked ransomware use as unknown for this Cisco issue. CISA directed organizations to apply vendor mitigations and said federal civilian executive branch agencies must remediate the flaw under applicable Binding Operational Directive requirements, with the catalog listing a remediation due date of **2026-07-16**; private-sector defenders were also urged to review the KEV entry and address affected devices in their environments.
Aug 15, 2026