Cisco Zero-Day Vulnerability (CVE-2025-20393) Exploited in the Wild

THE THREAT

On December 17th, 2025, Cisco published an advisory regarding a zero-day Remote Code Execution (RCE) vulnerability impacting Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager, tracked as CVE-2025-20393 (CVSS: 10). The vulnerability impacts both physical and virtual appliances that have the Spam Quarantine feature enabled and exposed to the Internet. At the time of writing, there is currently no patch available to address the vulnerability.

Cisco confirmed that exploitation of the vulnerability was first detected on December 10th, 2025, but goes back as early as November 2025, with attacks linked to a Chinese APT group tracked as UNC-9686. Successful exploitation of the vulnerability could allow attackers to obtain full remote control of the affected device, followed by post-compromise activities such as malware deployment.

As exploitation of the vulnerability has been observed, and no patches are available, it is critical that organizations utilizing these products in their environment apply the recommended mitigation steps outlined by Cisco.

What we're doing about it

• eSentire's Threat Response Unit has performed threat hunts for known Indicators of Compromise across customer environments
• eSentire Managed Vulnerability Service (MVS) will add the relevant plugins for CVE-2025-20393 as they become available
• eSentire MDR for Network has detections in place to identify traffic related to Chisel and webshells
• eSentire MDR for Endpoint has detections to identify webshell activity
• The eSentire Threat Intelligence team is actively tracking this topic for additional details and detection opportunities

What you should do about it

• Verify if the Spam Quarantine feature is enabled on Cisco Secure Email Gateway and Cisco Secure Email and Web Manager appliances
• If the feature is enabled, Cisco recommends restoring the appliance to a secure configuration or replacing the Virtual Appliance
• If restoring the appliance is not possible, Cisco recommends contacting Cisco Support (TAC) to perform further investigation
• Review current configurations, and if not required for business purposes, avoid exposing appliances to the Internet
• Disable network services that are not required (HTTP and FTP)
• Ensure Endpoint Detection and Response (EDR) agents are deployed to all corporate assets including workstations and servers
• Review the full Cisco advisory for additional hardening recommendations

Additional information

According to Cisco, CVE-2025-20393 only impacts Cisco Secure Email Gateway and Cisco Secure Email and Web Manager appliances that have the Spam Quarantine feature enabled and exposed to the Internet, which is a feature that is not enabled by default. Although there are no available patches, Cisco provides a multi-step list of recommended actions to restore impacted devices to a secure configuration, as rebuilding appliances is the only method of removing persistence mechanisms. Cisco also indicates that if restoring appliances is not possible, they advise contacting Cisco Support to check whether the appliance has been compromised.

On December 17th, Cisco Talos published a report providing details on attacks that were observed involving the exploitation of the vulnerability, which they attributed with "moderate confidence" to a Chinese APT tracked as UAT-9686. Cisco observed that successful exploitation of the vulnerability resulted in the deployment of the custom webshell AquaShell, a Python-based backdoor capable of receiving and executing encoded commands in the system shell. Reported attacks also resulted in the deployment of the reverse SSH tunneling tools AquaTunnel and Chisel, which can enable unauthorized remote access, along with the log-clearing tool AquaPurge.

Also on December 17th, CISA added CVE-2025-20393 to its Known Exploited Vulnerabilities (KEV) catalog, giving federal agencies a deadline of one week (December 24th, 2025) to apply the mitigation steps outlined by Cisco.

References:
[1] https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-20393
[3] https://blog.talosintelligence.com/uat-9686/
[4] https://www.cisa.gov/news-events/alerts/2025/12/17/cisa-adds-three-known-exploited-vulnerabilities-catalog