Cisco AsyncOS email appliance zero-day exploitation and remediation

**CVE-2025-20393** is a **maximum-severity** flaw in **Cisco AsyncOS Software** that affects **Cisco Secure Email Gateway** and **Cisco Secure Email and Web Manager** appliances when **Spam Quarantine** is enabled and reachable from the internet. Cisco said the issue was **actively exploited as a zero-day** by **UAT-9686**, who used it to gain **root-level command execution**, establish **persistence**, and deploy tools including **ReverseSSH (aka AquaTunnel)**, **Chisel**, **AquaPurge**, and **AquaShell**. Cisco has released security updates, and **CISA** added the CVE to **KEV**. The company also advised customers to reduce exposure by limiting internet access, disabling unnecessary services, and hardening appliance access controls.

The **UAT-9686** campaign is actively exploiting **CVE-2025-20393** on **Cisco AsyncOS** email appliances, giving attackers **root command execution** and a foothold for persistence. The activity targets **Secure Email Gateway (SEG)** and **Secure Email and Web Manager (SEWM)** appliances exposed through **Spam Quarantine** configurations on the Internet. Cisco first spotted the attacks on **December 10** and says the operation has been active since at least **late November 2025**.

Cisco released **security updates** for **CVE-2025-20393** in **Cisco AsyncOS Software** for **Cisco Secure Email Gateway** and **Cisco Secure Email and Web Manager**, closing a **maximum-severity** remote-command-execution flaw. The fix matters because the vulnerability had already been used as a **zero-day** and could grant attackers **root privileges** on affected appliances. Cisco also removed persistence mechanisms linked to the attack campaign. Administrators need to move to the fixed AsyncOS releases and harden exposure around the affected email security systems.