---
title: "Cisco AsyncOS CVE-2025-20393: Spam Quarantine Root RCE"
url: https://erroneo.us/security/briefs/cisco-asyncos-spam-quarantine-cve-2025-20393-rce/
description: "China-nexus zero-day gave root on Cisco email appliances with Spam Quarantine exposed. Fixed Jan 2026; verify builds, close the port, hunt for AquaShell."
type: security-brief
section: "Security Digest"
date_published: 2025-12-17
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-20393"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Cisco AsyncOS CVE-2025-20393: Spam Quarantine Root RCE

**Verdict: Check exposure.** Fixed since January 2026, but a Chinese-nexus APT used it as a zero-day for weeks; confirm every appliance is on a current build, keep Spam Quarantine off the internet, and have any appliance that exposed it before the fix checked for compromise.

- **Who must act:** Owners of on-premises Secure Email Gateway or Secure Email and Web Manager appliances that had Spam Quarantine reachable from the internet between late November 2025 and their January 2026 upgrade, or that still run older builds.
- **Who can relax:** Secure Email Cloud customers (Cisco says not affected), and on-premises teams that never enabled Spam Quarantine on an internet-facing interface and run current releases.
- **Affected:** Cisco Secure Email Gateway (physical and virtual) before 15.0.5-016, 15.5.4-012 or 16.0.4-016; Cisco Secure Email and Web Manager (physical and virtual) before 15.0.2-007, 15.5.4-007 or 16.0.4-010; Only when Spam Quarantine is enabled (off by default) and reachable from the internet
- **Fixed:** Secure Email Gateway: 15.0.5-016 (for 14.2 and earlier and 15.0), 15.5.4-012, 16.0.4-016 (Jan 15, 2026); Secure Email and Web Manager: 15.0.2-007 (for 15.0 and earlier), 15.5.4-007, 16.0.4-010 (Jan 15, 2026); Gateways should now be on 15.5.5-014 or 16.5.0-780 because of the later CVE-2026-76461 and CVE-2026-76519
- **CVEs:** CVE-2025-20393
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. List every Secure Email Gateway and Secure Email and Web Manager appliance and record its AsyncOS release with the version CLI command.
2. Upgrade Secure Email and Web Manager to 15.0.2-007, 15.5.4-007, 16.0.4-010 or later, and Secure Email Gateway to 16.5.0-780 or 15.5.5-014, which also cover the 2026 email-borne bugs.
3. Under Network > IP Interfaces, find every interface with Spam Quarantine checked and remove it from internet-facing interfaces or restrict it to trusted hosts behind a firewall.
4. If Spam Quarantine was internet-reachable before January 15, 2026, open a Cisco TAC case for a compromise check instead of relying on the upgrade alone.
5. Separate mail and management interfaces, disable HTTP and FTP, and forward logs to an external server so an attacker cannot wipe them locally.

### How to check if you are affected

- Search firewall, proxy and NetFlow logs for traffic between your appliances and 172.233.67.176, 172.237.29.147 or 38.54.56.95, the IPs Talos lists for UAT-9686.
- Look for outbound SSH or long-lived tunnels started by the appliance itself, consistent with AquaTunnel (ReverseSSH) and Chisel.
- Ask TAC to check /data/web/euq_webui/htdocs/index.py, where Talos found the AquaShell backdoor, and to review logs for keyword-based gaps left by AquaPurge.
- Enable Snort rules 65617, 65643, 65644 and 65645, which Cisco lists for this advisory, and match file hashes against the Talos IOC list.

## What happened

On December 17, 2025, Cisco published [cisco-sa-sma-attack-N9bf4](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4), warning of attacks on Secure Email Gateway (formerly ESA) and Secure Email and Web Manager (formerly SMA). CVE-2025-20393 is an input validation flaw (CWE-20) in the Spam Quarantine feature of AsyncOS. One crafted HTTP request lets an unauthenticated remote attacker run commands as root. Cisco scores it CVSS 3.1 10.0 on the [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-20393). Cisco learned of the campaign on December 10 from a TAC case; it hit "a limited subset of appliances" with certain ports open to the internet.

The same day, [Cisco Talos](https://blog.talosintelligence.com/uat-9686/) attributed the activity, with moderate confidence, to UAT-9686, a Chinese-nexus APT active since at least late November 2025. Its toolkit: AquaShell, a Python backdoor written into `/data/web/euq_webui/htdocs/index.py` that runs commands from unauthenticated POSTs; the AquaTunnel (ReverseSSH) and Chisel tunnels; and AquaPurge, which deletes chosen log lines. CISA added the CVE to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20393) that day, due December 24.

There was no patch at disclosure, only hardening advice. Cisco shipped fixed releases on January 15, 2026, as [The Hacker News](https://thehackernews.com/2026/01/cisco-patches-zero-day-rce-exploited-by.html) also reported. The advisory says the fix also "clears the persistence mechanisms that were identified in this attack campaign."

## Who is affected

Physical and virtual Secure Email Gateway and Secure Email and Web Manager appliances on releases before the fixed builds. All three conditions must hold: a vulnerable release, Spam Quarantine configured (it is off by default), and Spam Quarantine reachable from the internet. Cisco says Secure Email Cloud devices are not affected, and it knows of no exploitation against Secure Web.

## Do you really need to act?

Most appliances are past these builds, so the verdict is check exposure. Two things still matter.

First, the exposure window. An appliance that had Spam Quarantine open to the internet from late November 2025 until its upgrade may have been backdoored. The upgrade clears the persistence Cisco found, but root on a mail gateway yields credentials, and the tunnels reach other systems.

Second, "fixed for CVE-2025-20393" is not current. In September and October 2026, Cisco disclosed two more exploited root bugs in Secure Email Gateway that are triggered by email: CVE-2026-76461 and [CVE-2026-76519](https://www.cve.org/CVERecord?id=CVE-2026-76519), both now in KEV. A gateway on 15.0.5-016 or 15.5.4-012 is fixed for this CVE but not for those. The [September advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX) lists 15.5.5-014 and 16.5.0-780 as fixes.

## What to do now

1. List every appliance, including cluster members, and run `version` at the CLI on each.
2. Upgrade Secure Email and Web Manager to 15.0.2-007, 15.5.4-007 or 16.0.4-010 or later. Move gateways to 16.5.0-780 or 15.5.5-014. In the CLI, run `upgrade`, then `DOWNLOADINSTALL`.
3. Under Network > IP Interfaces (Management Appliance > Network > IP Interfaces on the manager), check which interfaces have Spam Quarantine enabled. Remove it from internet-facing interfaces or restrict it to trusted hosts.
4. If Spam Quarantine was exposed before January 15, 2026, open a TAC case for a compromise check with remote access enabled, as Cisco advises.
5. Separate mail and management interfaces, disable HTTP and FTP, and log to an external server.

## How to tell if you were hit

- Search firewall, proxy and NetFlow logs for traffic to or from 172.233.67.176, 172.237.29.147 and 38.54.56.95, the addresses Talos lists.
- Look for outbound SSH or long-lived HTTP tunnels started by the appliance itself.
- Ask TAC to inspect `index.py` in the Spam Quarantine web root and to look for log gaps left by AquaPurge.
- Enable Snort rules 65617, 65643, 65644 and 65645 and compare files against the hashes Talos published.

## Timeline

- Late Nov 2025 — UAT-9686 activity begins, per Talos.
- Dec 10, 2025 — Cisco becomes aware of the campaign.
- Dec 17, 2025 — Cisco advisory and Talos report published; CISA adds the CVE to KEV.
- Dec 24, 2025 — Federal remediation deadline, with no patch yet available.
- Jan 15, 2026 — Fixed releases ship; the advisory is marked final.
- Sep 14, 2026 — Cisco discloses CVE-2026-76461, a separate exploited gateway bug.

## Sources

1. [Cisco — Reports About Cyberattacks Against Cisco Secure Email Gateway And Cisco Secure Email and Web Manager (cisco-sa-sma-attack-N9bf4)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4)
2. [Cisco Talos — UAT-9686 actively targets Cisco Secure Email Gateway and Secure Email and Web Manager](https://blog.talosintelligence.com/uat-9686/)
3. [CVE record — CVE-2025-20393](https://www.cve.org/CVERecord?id=CVE-2025-20393)
4. [NVD — CVE-2025-20393](https://nvd.nist.gov/vuln/detail/CVE-2025-20393)
5. [CISA — Known Exploited Vulnerabilities: CVE-2025-20393](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-20393)
6. [Cisco — Cisco Secure Email Gateway SQL Injection Vulnerability (cisco-sa-esa-inj-2bLVGmhX)](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX)
7. [CVE record — CVE-2026-76519](https://www.cve.org/CVERecord?id=CVE-2026-76519)
8. [The Hacker News — Cisco Patches Zero-Day RCE Exploited by China-Linked APT in Secure Email Gateways](https://thehackernews.com/2026/01/cisco-patches-zero-day-rce-exploited-by.html)

---
Source page: https://erroneo.us/security/briefs/cisco-asyncos-spam-quarantine-cve-2025-20393-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt