Quick Summary
Cisco has reported a critical zero-day vulnerability, tracked as CVE-2025-20393, in its AsyncOS software, actively exploited by the UAT-9686 threat actor since December 10, 2025. This flaw allows attackers to execute arbitrary commands with root privileges on affected Cisco Secure Email Gateway and Cisco Secure Email and Web Manager appliances. Organizations using these products should be aware of the risks and take immediate action to secure their systems.
The Securityish Brief
Cisco has identified a maximum-severity zero-day vulnerability in its AsyncOS software, specifically affecting Cisco Secure Email Gateway and Cisco Secure Email and Web Manager appliances. The vulnerability, tracked as CVE-2025-20393, was discovered on December 10, 2025, and is linked to an advanced persistent threat actor known as UAT-9686. This flaw allows attackers to execute arbitrary commands with root privileges, posing significant risks to affected systems.
The exploitation of this vulnerability has been ongoing since at least late November 2025, with evidence of a persistence mechanism being established by the attackers to maintain control over compromised appliances. Cisco has noted that the Spam Quarantine feature must be enabled and exposed to the internet for successful exploitation, although this feature is not enabled by default.
Organizations using Cisco AsyncOS should take immediate steps to secure their appliances, as the UAT-9686 group has utilized various tools, including AquaTunnel and AquaShell, to facilitate their attacks. These tools enable attackers to create backdoors and maintain access to compromised systems.
Practical Implications for Users and Organizations
The active exploitation of CVE-2025-20393 highlights the critical need for organizations to regularly review and secure their configurations, especially for features that may expose systems to the internet. Users should ensure that unnecessary services are disabled and that strong authentication methods are in place.
In light of this incident, organizations should monitor their web log traffic for any unusual activity and consider segmenting their network to limit exposure. If a compromise is suspected, rebuilding the affected appliances may be necessary to eliminate any persistent threats.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, mandating that federal agencies implement mitigations by December 24, 2025. This underscores the urgency of addressing this issue across all sectors.
Key Takeaways
- Check if the Spam Quarantine feature is enabled on your Cisco appliances and disable it if not needed.
- Limit internet access to your Cisco appliances by securing them behind a firewall.
- Monitor web log traffic for any unexpected activity that may indicate a compromise.
- Implement strong authentication methods, such as SAML or LDAP, for accessing your devices.
- If you suspect a compromise, consider rebuilding your appliances to remove any persistent threats.
Key Terms & Concepts
- CVE-2025-20393: In this article, CVE-2025-20393 refers to a critical zero-day vulnerability in Cisco AsyncOS software that allows arbitrary command execution.
- UAT-9686: UAT-9686 is the codename for a China-nexus advanced persistent threat actor exploiting the Cisco AsyncOS vulnerability.
- AquaTunnel: AquaTunnel is a tunneling tool used by attackers to maintain access to compromised systems.
- AquaShell: AquaShell is a lightweight Python backdoor that can execute commands received via HTTP requests.
Read the original article here: https://thehackernews.com/2025/12/cisco-warns-of-active-attacks.html
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
