Cisco 0-Day RCE Secure Email Gateway Vulnerability Exploited in the Wild

Cisco has confirmed active exploitation of a critical zero-day remote code execution vulnerability impacting its Secure Email Gateway and Secure Email and Web Manager appliances.

Tracked as CVE-2025-20393, the flaw allows unauthenticated attackers to execute arbitrary root-level commands via crafted HTTP requests to the Spam Quarantine feature.

The vulnerability stems from insufficient validation of HTTP requests in the Spam Quarantine feature of Cisco AsyncOS Software, enabling remote command execution with root privileges on affected appliances.

Classified under CWE-20 (Improper Input Validation), it scores a maximum CVSSv3.1 base of 10.0, highlighting its network accessibility, low complexity, and full impact on confidentiality, integrity, and availability.

Exploitation targets appliances where Spam Quarantine is enabled and exposed to the internet, typically on port 6025, a configuration not enabled by default and discouraged in deployment guides.

Cisco became aware of the attacks on December 10, 2025, with evidence of exploitation dating back to November 2025.

Exploitation Campaign and Threat Actor

Cisco Talos attributes the campaign to UAT-9686 (also UNC-9686), a China-nexus advanced persistent threat actor, with moderate confidence based on tooling overlaps with groups like APT41 and UNC5174.

Attackers deploy a Python-based backdoor called AquaShell for persistent remote access, alongside reverse SSH tunneling tools like AquaTunnel and Chisel for internal pivoting, and AquaPurge for log wiping to evade detection. Targets include telecommunications and critical infrastructure sectors, with post-exploitation focusing on espionage rather than ransomware.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-20393 to its Known Exploited Vulnerabilities catalog on December 17, 2025, mandating federal agencies to mitigate by December 24, 2025. No public proof-of-concept exploits exist as of January 2026, but automated scanning has increased.

Indicators of compromise include the implanted persistence mechanism, a covert channel for remote access; Cisco recommends verifying via Technical Assistance Center (TAC) support with remote access enabled.

Mitigation and Fixed Releases

Cisco released patches addressing the vulnerability and removing known persistence mechanisms; no workarounds exist. Administrators should upgrade immediately and confirm Spam Quarantine status via the web interface under Network > IP Interfaces.

Cisco Secure Email Gateway Fixed Releases

Cisco Secure Email and Web Manager Fixed Releases

Additional hardening includes firewalling, separating mail/management interfaces, disabling unnecessary services such as HTTP/FTP, and using strong authentication protocols such as SAML or LDAP.

Cisco Secure Email Cloud services remain unaffected. Organizations should monitor logs externally and contact TAC for compromise assessment.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.