{"id":9946,"date":"2026-01-17T10:04:13","date_gmt":"2026-01-17T10:04:13","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/01\/17\/cisco-0-day-rce-secure-email-gateway-vulnerability-exploited-in-the-wild\/"},"modified":"2026-01-17T10:04:13","modified_gmt":"2026-01-17T10:04:13","slug":"cisco-0-day-rce-secure-email-gateway-vulnerability-exploited-in-the-wild","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/01\/17\/cisco-0-day-rce-secure-email-gateway-vulnerability-exploited-in-the-wild\/","title":{"rendered":"Cisco 0-Day RCE Secure Email Gateway Vulnerability Exploited in the Wild"},"content":{"rendered":"

Cisco 0-Day RCE Secure Email Gateway Vulnerability Exploited in the Wild
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Cisco has confirmed active exploitation of a critical zero-day remote code execution vulnerability in its Secure Email Gateway and Secure Email and Web Manager appliances. <\/p>\n

Tracked as CVE-2025-20393<\/a>, the flaw allows unauthenticated attackers to execute arbitrary root-level commands via crafted HTTP requests to the Spam Quarantine feature.<\/p>\n

The vulnerability stems from insufficient validation of HTTP requests in the Spam Quarantine feature of Cisco AsyncOS Software, enabling remote command execution with root privileges on affected appliances.<\/p>\n

Classified under CWE-20 (Improper Input Validation), it scores a maximum CVSSv3.1 base of 10.0, highlighting its network accessibility, low complexity, and full impact on confidentiality, integrity, and availability.<\/p>\n

Exploitation targets appliances where Spam Quarantine is enabled and exposed to the internet, typically on port 6025, a configuration not enabled by default and discouraged in deployment guides.<\/p>\n

\n\n\n\n\n\n
CVE ID<\/th>\nCVSS Score<\/th>\nVector String<\/th>\nCWE ID<\/th>\nBug IDs<\/th>\n<\/tr>\n<\/thead>\n
CVE-2025-20393<\/td>\n10.0<\/td>\nCVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:H\/A:H<\/td>\nCWE-20<\/td>\nCSCws36549, CSCws52505 <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

Cisco became aware of the attacks on December 10, 2025, with evidence of exploitation dating back to November 2025.<\/p>\n

Exploitation Campaign and Threat Actor<\/strong><\/h2>\n

Cisco Talos attributes the campaign to UAT-9686<\/a> (also UNC-9686), a China-nexus advanced persistent threat actor, with moderate confidence based on tooling overlaps with groups like APT41 and UNC5174.<\/p>\n

Attackers deploy a Python-based backdoor called AquaShell for persistent remote access, alongside reverse SSH tunneling tools like AquaTunnel and Chisel for internal pivoting, and AquaPurge for log wiping to evade detection. Targets include telecommunications and critical infrastructure sectors, with post-exploitation focusing on espionage rather than ransomware.<\/p>\n

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-20393<\/a> to its Known Exploited Vulnerabilities catalog on December 17, 2025, mandating federal agencies to mitigate by December 24, 2025. No public proof-of-concept exploits exist as of January 2026, but automated scanning has increased.<\/p>\n

Indicators of compromise include the implanted persistence mechanism, a covert channel for remote access; Cisco recommends verifying via Technical Assistance Center (TAC) support with remote access enabled.<\/p>\n

Mitigation and Fixed Releases<\/strong><\/h2>\n

Cisco released patches<\/a> addressing the vulnerability and removing known persistence mechanisms; no workarounds exist. Administrators should upgrade immediately and confirm Spam Quarantine status via the web interface under Network > IP Interfaces.<\/p>\n

Cisco Secure Email Gateway Fixed Releases<\/strong><\/p>\n

\n\n\n\n\n\n\n\n\n
Vulnerable Release<\/th>\nFirst Fixed Release<\/th>\n<\/tr>\n<\/thead>\n
14.2 and earlier<\/td>\n15.0.5-016<\/td>\n<\/tr>\n
15.0<\/td>\n15.0.5-016<\/td>\n<\/tr>\n
15.5<\/td>\n15.5.4-012<\/td>\n<\/tr>\n
16.0<\/td>\n16.0.4-016<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

Cisco Secure Email and Web Manager Fixed Releases<\/strong><\/p>\n

\n\n\n\n\n\n\n\n
Vulnerable Release<\/th>\nFirst Fixed Release<\/th>\n<\/tr>\n<\/thead>\n
15.0 and earlier<\/td>\n15.0.2-007<\/td>\n<\/tr>\n
15.5<\/td>\n15.5.4-007<\/td>\n<\/tr>\n
16.0<\/td>\n16.0.4-010<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

Additional hardening includes firewalling, separating mail\/management interfaces, disabling unnecessary services such as HTTP\/FTP, and using strong authentication<\/a> protocols such as SAML or LDAP.<\/p>\n

Cisco Secure Email Cloud services remain unaffected. Organizations should monitor logs externally and contact TAC for compromise assessment.<\/p>\n

Follow us on Google News<\/a>, LinkedIn<\/a>, and X<\/a> for daily cybersecurity updates. Contact us<\/a> to feature your stories.<\/strong><\/p>\n

The post Cisco 0-Day RCE Secure Email Gateway Vulnerability Exploited in the Wild<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Guru Baran
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Cisco 0-Day RCE Secure Email Gateway Vulnerability Exploited in the Wild Cisco has confirmed active exploitation of a critical zero-day remote code execution vulnerability in its Secure Email Gateway and Secure Email and Web Manager appliances. Tracked as CVE-2025-20393, the flaw allows unauthenticated attackers to execute arbitrary root-level commands via crafted HTTP requests to the […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,648],"tags":[130],"class_list":["post-9946","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-vulnerability-news","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/9946"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=9946"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/9946\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=9946"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=9946"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=9946"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}