Cisco AsyncOS CVE-2025-20393 Zero-Day Exploited Against Secure Email Appliances

Cisco released fixes for a maximum-severity vulnerability in AsyncOS (tracked as CVE-2025-20393, CVSS 10.0) affecting Cisco Secure Email Gateway (SEG) and Secure Email and Web Manager (SEWM) appliances. Cisco reported the issue was exploited as a zero-day in attacks against a limited subset of internet-exposed appliances, enabling attackers to execute arbitrary commands with root privileges on the underlying operating system. The flaw was attributed to insufficient HTTP request validation in the Spam Quarantine feature, allowing crafted HTTP requests to trigger root-level command execution.

Cisco and Cisco Talos attributed the exploitation activity to UAT-9686, described as a China-linked threat group, with activity observed since at least late November 2025 and detected by Cisco on December 10. Cisco stated the intrusions included deployment of a persistence mechanism to maintain control over compromised appliances, and indicated that the released software updates both remediate the vulnerability and remove related persistence mechanisms; Cisco urged affected customers to upgrade to fixed releases per the updated advisory.