erroneo.us
Search all guides⌘K

Security Digest · Dec 17, 2025 · Vulnerability · Network edge

Cisco AsyncOS CVE-2025-20393: Spam Quarantine Root RCE

China-nexus zero-day gave root on Cisco email appliances with Spam Quarantine exposed. Fixed Jan 2026; verify builds, close the port, hunt for AquaShell.

Published By erroneo.us Security Desk · Updated 3 min read8 sources

Our verdict

Check exposure

Fixed since January 2026, but a Chinese-nexus APT used it as a zero-day for weeks; confirm every appliance is on a current build, keep Spam Quarantine off the internet, and have any appliance that exposed it before the fix checked for compromise.

Who must act: Owners of on-premises Secure Email Gateway or Secure Email and Web Manager appliances that had Spam Quarantine reachable from the internet between late November 2025 and their January 2026 upgrade, or that still run older builds.

Who can relax: Secure Email Cloud customers (Cisco says not affected), and on-premises teams that never enabled Spam Quarantine on an internet-facing interface and run current releases.

Affected
Cisco Secure Email Gateway (physical and virtual) before 15.0.5-016, 15.5.4-012 or 16.0.4-016
Cisco Secure Email and Web Manager (physical and virtual) before 15.0.2-007, 15.5.4-007 or 16.0.4-010
Only when Spam Quarantine is enabled (off by default) and reachable from the internet
Fixed in
Secure Email Gateway: 15.0.5-016 (for 14.2 and earlier and 15.0), 15.5.4-012, 16.0.4-016 (Jan 15, 2026)
Secure Email and Web Manager: 15.0.2-007 (for 15.0 and earlier), 15.5.4-007, 16.0.4-010 (Jan 15, 2026)
Gateways should now be on 15.5.5-014 or 16.5.0-780 because of the later CVE-2026-76461 and CVE-2026-76519
CVSS
10.0 (v3.1, vendor)
EPSS
32.4% (percentile 98)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. List every Secure Email Gateway and Secure Email and Web Manager appliance and record its AsyncOS release with the version CLI command.
  2. Upgrade Secure Email and Web Manager to 15.0.2-007, 15.5.4-007, 16.0.4-010 or later, and Secure Email Gateway to 16.5.0-780 or 15.5.5-014, which also cover the 2026 email-borne bugs.
  3. Under Network > IP Interfaces, find every interface with Spam Quarantine checked and remove it from internet-facing interfaces or restrict it to trusted hosts behind a firewall.
  4. If Spam Quarantine was internet-reachable before January 15, 2026, open a Cisco TAC case for a compromise check instead of relying on the upgrade alone.
  5. Separate mail and management interfaces, disable HTTP and FTP, and forward logs to an external server so an attacker cannot wipe them locally.

How to check if you are affected or compromised

  • Search firewall, proxy and NetFlow logs for traffic between your appliances and 172.233.67.176, 172.237.29.147 or 38.54.56.95, the IPs Talos lists for UAT-9686.
  • Look for outbound SSH or long-lived tunnels started by the appliance itself, consistent with AquaTunnel (ReverseSSH) and Chisel.
  • Ask TAC to check /data/web/euq_webui/htdocs/index.py, where Talos found the AquaShell backdoor, and to review logs for keyword-based gaps left by AquaPurge.
  • Enable Snort rules 65617, 65643, 65644 and 65645, which Cisco lists for this advisory, and match file hashes against the Talos IOC list.

What happened#

On December 17, 2025, Cisco published cisco-sa-sma-attack-N9bf4, warning of attacks on Secure Email Gateway (formerly ESA) and Secure Email and Web Manager (formerly SMA). CVE-2025-20393 is an input validation flaw (CWE-20) in the Spam Quarantine feature of AsyncOS. One crafted HTTP request lets an unauthenticated remote attacker run commands as root. Cisco scores it CVSS 3.1 10.0 on the CVE record. Cisco learned of the campaign on December 10 from a TAC case; it hit "a limited subset of appliances" with certain ports open to the internet.

The same day, Cisco Talos attributed the activity, with moderate confidence, to UAT-9686, a Chinese-nexus APT active since at least late November 2025. Its toolkit: AquaShell, a Python backdoor written into /data/web/euq_webui/htdocs/index.py that runs commands from unauthenticated POSTs; the AquaTunnel (ReverseSSH) and Chisel tunnels; and AquaPurge, which deletes chosen log lines. CISA added the CVE to KEV that day, due December 24.

There was no patch at disclosure, only hardening advice. Cisco shipped fixed releases on January 15, 2026, as The Hacker News also reported. The advisory says the fix also "clears the persistence mechanisms that were identified in this attack campaign."

Who is affected#

Physical and virtual Secure Email Gateway and Secure Email and Web Manager appliances on releases before the fixed builds. All three conditions must hold: a vulnerable release, Spam Quarantine configured (it is off by default), and Spam Quarantine reachable from the internet. Cisco says Secure Email Cloud devices are not affected, and it knows of no exploitation against Secure Web.

Do you really need to act?#

Most appliances are past these builds, so the verdict is check exposure. Two things still matter.

First, the exposure window. An appliance that had Spam Quarantine open to the internet from late November 2025 until its upgrade may have been backdoored. The upgrade clears the persistence Cisco found, but root on a mail gateway yields credentials, and the tunnels reach other systems.

Second, "fixed for CVE-2025-20393" is not current. In September and October 2026, Cisco disclosed two more exploited root bugs in Secure Email Gateway that are triggered by email: CVE-2026-76461 and CVE-2026-76519, both now in KEV. A gateway on 15.0.5-016 or 15.5.4-012 is fixed for this CVE but not for those. The September advisory lists 15.5.5-014 and 16.5.0-780 as fixes.

What to do now#

  1. List every appliance, including cluster members, and run version at the CLI on each.
  2. Upgrade Secure Email and Web Manager to 15.0.2-007, 15.5.4-007 or 16.0.4-010 or later. Move gateways to 16.5.0-780 or 15.5.5-014. In the CLI, run upgrade, then DOWNLOADINSTALL.
  3. Under Network > IP Interfaces (Management Appliance > Network > IP Interfaces on the manager), check which interfaces have Spam Quarantine enabled. Remove it from internet-facing interfaces or restrict it to trusted hosts.
  4. If Spam Quarantine was exposed before January 15, 2026, open a TAC case for a compromise check with remote access enabled, as Cisco advises.
  5. Separate mail and management interfaces, disable HTTP and FTP, and log to an external server.

How to tell if you were hit#

  • Search firewall, proxy and NetFlow logs for traffic to or from 172.233.67.176, 172.237.29.147 and 38.54.56.95, the addresses Talos lists.
  • Look for outbound SSH or long-lived HTTP tunnels started by the appliance itself.
  • Ask TAC to inspect index.py in the Spam Quarantine web root and to look for log gaps left by AquaPurge.
  • Enable Snort rules 65617, 65643, 65644 and 65645 and compare files against the hashes Talos published.

Timeline#

  • — UAT-9686 activity begins, per Talos.
  • — Cisco becomes aware of the campaign.
  • — Cisco advisory and Talos report published; CISA adds the CVE to KEV.
  • — Federal remediation deadline, with no patch yet available.
  • — Fixed releases ship; the advisory is marked final.
  • — Cisco discloses CVE-2026-76461, a separate exploited gateway bug.

Vulnerability records

  • CVE-2025-20393 · KEV 2025-12-17 · A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Cisco — Reports About Cyberattacks Against Cisco Secure Email Gateway And Cisco Secure Email and Web Manager (cisco-sa-sma-attack-N9bf4) sec.cloudapps.cisco.com
  2. Cisco Talos — UAT-9686 actively targets Cisco Secure Email Gateway and Secure Email and Web Manager blog.talosintelligence.com
  3. CVE record — CVE-2025-20393 cve.org
  4. NVD — CVE-2025-20393 nvd.nist.gov
  5. CISA — Known Exploited Vulnerabilities: CVE-2025-20393 cisa.gov
  6. Cisco — Cisco Secure Email Gateway SQL Injection Vulnerability (cisco-sa-esa-inj-2bLVGmhX) sec.cloudapps.cisco.com
  7. CVE record — CVE-2026-76519 cve.org

Coverage and analysis

  1. The Hacker News — Cisco Patches Zero-Day RCE Exploited by China-Linked APT in Secure Email Gateways thehackernews.com