Cisco finally fixes AsyncOS zero-day exploited since November

​Cisco has finally patched a maximum-severity Cisco AsyncOS zero-day exploited in attacks against Secure Email Gateway (SEG) and Secure Email and Web Manager (SEWM) appliances since November 2025. As Cisco explained in December, when it disclosed the vulnerability (CVE-2025-20393), it affects only Cisco SEG and Cisco SEWM appliances with non-standard configurations when the Spam Quarantine feature is enabled and exposed on the Internet. "Cisco Secure Email Gateway, Secure Email, AsyncOS Software, and Web Manager appliances contains an improper input validation vulnerability that allows threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance," Cisco said. Detailed instructions for upgrading vulnerable appliances to a fixed software version are available in this security advisory. Cisco Talos, the company's threat intelligence research team, believes that a Chinese hacking group tracked as UAT-9686 is likely behind attacks abusing the flaw to execute arbitrary commands with root privileges. While investigating the attacks, Cisco Talos observed the threat actors deploying AquaShell persistent backdoors, AquaTunnel and Chisel reverse-SSH tunnel malware implants, and the AquaPurge log-clearing tool to wipe traces of their malicious activity. AquaTunnel and other malicious tools deployed in this campaign have also been linked in the past to other Chinese state-backed threat groups, such as APT41 and UNC5174. "We ...