DaystoPatch

CiscoExploited incident

Cyberattacks against Cisco Secure Email Gateway and Secure Email and Web Manager (AsyncOS, UAT-9686)

CVE-2025-20393Critical, CVSS 10.0In CISA's Known Exploited Vulnerabilities catalog since 17 Dec 2025

  • Exploited before a fix
FixedFixed for every supported version 29 days after the first public report.
Embed this live clock

Response

Silence
0h
First public report to first vendor statementUnverified source
Exposure
29d
First public report to first fix
Follow-through
29d
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Cisco PSIRT advisory cisco-sa-sma-attack-N9bf4, v1.0 Interim (Wayback snapshot 2025-12-17)CuratedQuote verified

    On December 10, Cisco became aware of a new cyberattack campaign targeting a limited subset of appliances with certain ports open to the internet that are running Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager.

    First public signal: v1.0 ('First Published: 2025 December 17 16:00 GMT'), published with no fix. Cisco Talos covered the campaign (UAT-9686) the same day. Cisco learned of it privately on 2025-12-10.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:5317e2cc837bd72a…
    Used in metrics
    Yes
    Dispute this timestamp
    5 more sources for this moment
    CISA KEV (CVE-2025-20393)ClaimedQuote verified17 Dec 2025

    Cisco Multiple Products Improper Input Validation Vulnerability

    Added to CISA's KEV catalog on 2025-12-17.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Cisco advisory cisco-sa-sma-attack-N9bf4ClaimedQuote verified17 Dec 2025, 16:00 UTC

    vulnerability exploited by the threat actors as part of the cyberattack campaign. Details about this vulnerability are as follows: CVE-2025-20393: Cisco Secure Email Gateway And Cisco Secure Email and Web Manager Remote Command Execution Vulnerability A vulnerability in the Spam

    The vendor's own disclosure.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:8bd7fd762c90f5b3…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2025-20393ClaimedQuote verified17 Dec 2025, 16:47 UTC

    A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:5f1243069a502165…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet17 Dec 2025, 17:00 UTC

    You can now share your thoughts on vulnerability CVE-2025-20393 in Vulnerability-Lookup:

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet21 Dec 2025, 21:00 UTC

    📢 Zero‑day CVE‑2025‑20393 exploité contre des appliances email Cisco, sans correctif disponible 📝 TechCrunch relaie que Cisco a confirmé l’explo... 📖 cyberveille : https://

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosureUnverified: no archived copy, quote not checked yet

    Cisco PSIRT advisory cisco-sa-sma-attack-N9bf4CuratedQuote not checked yet

    First Published: 2025 December 17 16:00 GMT

    CSAF 1.0.0 is dated 2025-12-17T16:00:23+00:00.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Cisco advisory cisco-sa-sma-attack-N9bf4ClaimedQuote verified17 Dec 2025, 16:00 UTC

    Initial public release.

    From the advisory's revision history.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:746f83c50f72cf46…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    at disclosure

    Cisco PSIRT advisory cisco-sa-sma-attack-N9bf4, v1.0 Interim (Wayback snapshot 2025-12-17)CuratedQuote verified

    In addition, Cisco strongly recommends restricting access to the appliance and implementing robust access control mechanisms to ensure that ports are not exposed to unsecured networks.

    Exposure-reduction guidance in the v1.0 Recommendations section; Cisco stated 'There are no workarounds identified that directly mitigate the risk concerning this attack campaign'.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:5317e2cc837bd72a…
    Used in metrics
    Yes
    Dispute this timestamp

  4. First fix

    +29d

    Cisco CSAF for cisco-sa-sma-attack-N9bf4, revision 2.0.0CuratedQuote verified

    Aligned with Cisco Business Unit fixes for code releases. Added information about the vulnerability. Added CSCws52505. Updated affected products and added fixed releases.

    CSAF revision 2.0.0 is dated 2026-01-15T16:01:43+00:00; the Wayback snapshot of 2026-01-16 shows 'Last Updated: 2026 January 15 16:01 GMT Version 2.0'. v1.0 had no Fixed Software section.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:8bd7fd762c90f5b3…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Cisco advisory cisco-sa-sma-attack-N9bf4ClaimedQuote verified15 Jan 2026, 16:01 UTC

    Aligned with Cisco Business Unit fixes for code releases. Added information about the vulnerability. Added CSCws52505. Updated affected products and added fixed releases.

    CaveatRevision adds fix information; an earlier fix may already have existed.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:746f83c50f72cf46…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    +29d

    Cisco PSIRT advisory cisco-sa-sma-attack-N9bf4, v2.0 (Wayback snapshot 2026-01-16)CuratedQuote verified

    Last Updated: 2026 January 15 16:01 GMT

    v2.0 lists fixed releases for every train at once: Secure Email Gateway 15.0.5-016 (14.2 and earlier, 15.0), 15.5.4-012, 16.0.4-016; Secure Email and Web Manager 15.0.2-007, 15.5.4-007, 16.0.4-010.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:729b7335953131cb…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

Cisco email security appliances attacked via zero-day; fixes since 15 Jan 2026

Attackers exploited an unpatched flaw in Cisco AsyncOS to take root control of some internet-exposed Cisco email security appliances; Cisco warned on 17 December 2025 and shipped fixes on 15 January 2026.

In plain words

Attackers were breaking into some Cisco email security appliances that had management ports open to the internet, using a flaw for which there was no fix at first. Cisco warned customers on 17 December 2025 and released fixed software on 15 January 2026. If we run these appliances ourselves, they must be upgraded and kept off the open internet, and any appliance that was exposed should be checked by Cisco support and rebuilt if it was compromised.

What happened and who is affected

What happened

On 17 December 2025 Cisco disclosed an active attack campaign against Cisco Secure Email Gateway and Secure Email and Web Manager appliances with certain ports open to the internet, letting attackers run commands as root and plant a persistence mechanism (CVE-2025-20393, scored 10.0). No fix existed at first; Cisco advised restricting access and, for compromised appliances, rebuilding them. Cisco Talos attributed the activity to a group it tracks as UAT-9686. Fixed AsyncOS releases for every train followed on 15 January 2026.

Who is affected

Cisco Secure Email Gateway on AsyncOS before 15.0.5-016, 15.5.4-012 and 16.0.4-016, and Cisco Secure Email and Web Manager before 15.0.2-007, 15.5.4-007 and 16.0.4-010, especially appliances whose web management interface or Spam Quarantine port is reachable from the internet.

CVE-2025-20393. Reviewed 22 Oct 2026. https://daystopatch.com/incidents/cisco-cve-2025-20393/

Affected products

  • Cisco Secure Email Gateway (AsyncOS)
  • Cisco Secure Email and Web Manager (AsyncOS)
  • Cisco Secure Email Cloud
How we built this timeline

Zero-day: exploitation disclosed with no fix on 17 Dec 2025; fixes followed 29 days later (15 Jan 2026). KEV listed it on 17 Dec 2025 with the note 'Apply any final mitigations provided by the vendor as soon as they become available'. v2.0 also added a second bug ID (CSCws52505).

The world quote says 'On December 10' without a year; the advisory is dated 17 Dec 2025, so it is 10 Dec 2025 (Cisco's private awareness date, not a public signal).

Related

Cisco report card