VulnRadar

Data against noise.

Page generated: 09 Nov 2026, 05:52 UTC

CVE-2025-20393

Read full description

A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges. This vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.

CVSS 10.0 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

0.0/10

REALITY · THREAT PRIORITY

8.7/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 10: +1.50
Fresh EPSS: 32.39%: +0.16

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 23 documents and public datasets.

Hype components

Headline sample (25%)

0/100

Press, 30 days (60%)

0/100

Grounded branding (15%)

0/100

HYPE TOTAL0/100

Sources and documents

Network World

Press · 16 Jan 2026, 08:00 · Cisco finally patches seven-week-old zero-day flaw in Secure Email Gateway products - Network World

Help Net Security

Press · 16 Jan 2026, 08:00 · Cisco fixes AsyncOS vulnerability exploited in zero-day attacks (CVE-2025-20393) - Help Net Security

The Hacker News

Press · 16 Jan 2026, 08:00 · Cisco Patches Zero-Day RCE Exploited by China-Linked APT in Secure Email Gateways - The Hacker News

CyberSecurityNews

Press · 16 Jan 2026, 08:00 · Cisco 0-Day RCE Secure Email Gateway Vulnerability Exploited in the Wild - CyberSecurityNews

Security Affairs

Press · 16 Jan 2026, 08:00 · China-linked APT UAT-9686 abused now patched maximum severity AsyncOS bug - Security Affairs

See all 23 source documents

BleepingComputer

Press · 16 Jan 2026, 08:00 · Cisco finally fixes AsyncOS zero-day exploited since November - BleepingComputer

SecurityWeek

Press · 16 Jan 2026, 08:00 · Cisco Patches Vulnerability Exploited by Chinese Hackers - SecurityWeek

Recorded Future

Press · 13 Jan 2026, 08:00 · December 2025 CVE Landscape: 22 Critical Vulnerabilities Mark 120% Surge, React2Shell Dominates Threat Activity - Recorded Future

SOC Prime

Press · 23 Dec 2025, 08:00 · CVE-2025-14733 Vulnerability: WatchGuard Addresses a Critical RCE Affecting Firebox Firewalls, Actively Exploited for Real-World Attacks - SOC Prime

CyberSecurityNews

Press · 19 Dec 2025, 08:00 · New Tool Released to Detect Cisco Secure Email Gateway 0-Day Vulnerability Exploited in the Wild - CyberSecurityNews

Kroll

Press · 19 Dec 2025, 08:00 · Cisco CVE-2025-20393: Critical Vulnerability | Kroll Threat Intelligence - Kroll

TechCrunch

Press · 19 Dec 2025, 08:00 · Hundreds of Cisco customers are vulnerable to new Chinese hacking campaign, researchers say - TechCrunch

Dark Reading

Press · 19 Dec 2025, 08:00 · Cisco VPNs, Email Services Hit in Separate Threat Campaigns - Dark Reading

SOCRadar

Press · 18 Dec 2025, 08:00 · CVE-2025-20393: Cisco AsyncOS Zero-Day Impacts Secure Email Appliances - SOCRadar

Forbes

Press · 18 Dec 2025, 08:00 · Cisco Secure Email Attacks: 0-Day Exploit Confirmed, No Fix Available - Forbes

The Hacker News

Press · 18 Dec 2025, 08:00 · Cisco Warns of Active Attacks Exploiting Unpatched 0-Day in AsyncOS Email Security Appliances - The Hacker News

The Record from Recorded Future News

Press · 18 Dec 2025, 08:00 · Chinese attackers exploiting zero-day to target Cisco email security products - The Record from Recorded Future News

SOC Prime

Press · 18 Dec 2025, 08:00 · CVE-2025-20393 Exploitation: A Maximum-Severity Zero-Day Vulnerability in Cisco AsyncOS Software Abused in Attacks by the China-Backed APT UAT-9686 - SOC Prime

SecurityWeek

Press · 18 Dec 2025, 08:00 · China-Linked Hackers Exploiting Zero-Day in Cisco Security Gear - SecurityWeek

Hong Kong Computer Emergency Response Team Coordination Centre

Press · 18 Dec 2025, 08:00 · Cisco AsyncOS Remote Code Execution Vulnerability - Hong Kong Computer Emergency Response Team Coordination Centre

The Times of India

Press · 18 Dec 2025, 08:00 · Cisco has a 'Chinese warning': Critical flaw gives Chinese hackers complete access to... - The Times of India

BleepingComputer

Press · 17 Dec 2025, 08:00 · Cisco warns of unpatched AsyncOS zero-day exploited in attacks - BleepingComputer

Help Net Security

Press · 17 Dec 2025, 08:00 · Cisco email security appliances rooted and backdoored via still unpatched zero-day - Help Net Security

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.7 (2026-11-02 15:13). The curve appears once the score changes.

Public exploit evidence

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 10; EPSS 32.4%
Attention, last 30 days: 0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential: network access, no prior privileges, no user interaction.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:29.589072+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

Added to the CISA KEV catalog

17 Dec 2025, 00:00

First press mention

17 Dec 2025, 08:00

Published

17 Dec 2025, 16:47

Latest press mention

16 Jan 2026, 08:00

Score calculated

05 Nov 2026, 13:59