Cisco Zero-Day Vulnerability (CVE-2025-20393) (CVSS 10) Exploited in the Wild: An In-Depth Analysis

Estimated reading time: 8-9 minutes

Key Takeaways

  • Cisco Zero-Day (CVE-2025-20393), with a CVSS score of 10.0, is under active exploitation by a Chinese APT group (UNC-9686), impacting Cisco Secure Email Gateway and Secure Email and Web Manager. No patch is currently available.
  • The vulnerability allows unauthenticated Remote Code Execution (RCE) when the Spam Quarantine feature is enabled and exposed to the internet, granting attackers full control over compromised devices.
  • Threat actors are deploying sophisticated tools, including a custom Python webshell named AquaShell, reverse SSH tunnels (AquaTunnel, Chisel), and a log wiper (AquaPurge) to maintain persistence and evade detection.
  • Immediate mitigation is critical: isolate vulnerable devices from public access, restore from secure backups, disable unnecessary services, and enhance endpoint detection and response (EDR) capabilities.
  • Organizations must invest in advanced security technologies like cyber threat intelligence platform solutions, PurpleOps Solutions, and PurpleOps Solutions, informed by PurpleOps Solutions and PurpleOps Solutions, for proactive defense.

Table of Contents

On December 17th, 2025, Cisco disclosed a critical zero-day Remote Code Execution (RCE) vulnerability, identified as CVE-2025-20393. This vulnerability, impacting Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager, carries a CVSS score of 10.0, indicating the highest level of severity. Crucially, the vulnerability has been actively exploited in the wild, with confirmed attacks detected as early as December 10th, 2025, and evidence suggesting activity dating back to November 2025. This situation demands immediate attention from all organizations utilizing these Cisco products, as no patch is currently available. This analysis will detail the nature of CVE-2025-20393, outline the tactics employed by threat actors, provide context on other significant vulnerabilities recently highlighted by cybersecurity authorities, and offer actionable advice for both technical teams and business leaders to mitigate associated risks.

The Cisco Zero-Day Vulnerability (CVE-2025-20393)

The Cisco zero-day vulnerability (CVE-2025-20393) affects both physical and virtual appliances where the Spam Quarantine feature is enabled and exposed to the internet. The RCE nature of this flaw allows unauthenticated attackers to execute arbitrary code remotely without requiring user interaction, making it highly attractive to malicious actors. Cisco’s advisory confirms that exploitation has been observed, attributing the attacks to a Chinese Advanced Persistent Threat (APT) group tracked as UNC-9686, also referred to as UAT-9686 by Cisco Talos.

Successful exploitation of CVE-2025-20393 grants attackers full remote control over the compromised device. This level of access enables sophisticated post-compromise activities, including the deployment of additional malware, data exfiltration, and the establishment of persistent access within the targeted network. Given the widespread use of Cisco Secure Email Gateway and Secure Email and Web Manager in enterprise environments, the potential impact of this zero-day is substantial, threatening critical communication infrastructure and sensitive organizational data. The absence of an immediate patch elevates the urgency for organizations to implement recommended mitigation strategies to prevent or detect compromise. Proactive use of a comprehensive cyber threat intelligence platform can provide early warnings about such threats, helping security teams understand attacker motives and methods before widespread exploitation occurs. Monitoring PurpleOps Solutions and PurpleOps Solutions feeds can also provide insights into discussions related to new zero-day exploits and their potential sale or deployment, giving organizations a vital heads-up.

Technical Deep Dive and Attacker Tactics

Cisco Talos, in its report published on December 17th, provided further technical details on the observed attacks exploiting CVE-2025-20393. The report indicates that following successful exploitation, attackers deployed a custom Python-based webshell named AquaShell. This backdoor is designed to receive and execute encoded commands within the system shell, providing a persistent and flexible mechanism for remote control. The deployment of a webshell is a common tactic for maintaining access and escalating privileges on compromised systems, making PurpleOps Solutions systems crucial for identifying such tools.

Beyond AquaShell, attackers also utilized reverse SSH tunneling tools, specifically AquaTunnel and Chisel. These tools facilitate unauthorized remote access by creating encrypted tunnels that can bypass firewall rules and network segmentation, effectively establishing covert communication channels for command and control. The ability of these tools to hide traffic makes them challenging to detect without advanced cyber threat intelligence platform capabilities that analyze anomalous network behavior. Furthermore, the threat actors deployed AquaPurge, a tool used for clearing logs. This action aims to erase forensic evidence of the attack, complicating incident response and recovery efforts. The sophistication of these tools and the coordinated deployment underscore the capabilities of the UNC-9686 APT group and their intent to maintain stealth and persistence.

The severity of CVE-2025-20393 led the Cybersecurity and Infrastructure Security Agency (CISA) to add it to its Known Exploited Vulnerabilities (KEV) catalog on December 17th, 2025. This inclusion mandates that federal agencies apply the outlined mitigation steps by December 24th, 2025, highlighting the critical nature of this vulnerability and the immediate need for action across all sectors. The rapid response from CISA underscores the potential for widespread impact and the importance of addressing zero-day threats with aggressive mitigation strategies, particularly when PurpleOps Solutions indicates high-impact exploitation. Early detection of such sophisticated toolchains is paramount to preventing a full-scale compromise. Organizations should assess if their existing PurpleOps Solutions integrations can provide relevant alerts based on observed indicators of compromise (IOCs) related to these attack tools.

Broader Context: Other Critical Vulnerabilities and KEV Listings

The Cisco zero-day is not an isolated incident. The cybersecurity landscape consistently presents new and actively exploited vulnerabilities that demand attention. Another critical RCE flaw, CVE-2025-14733, impacts WatchGuard Firebox devices. This vulnerability, affecting Firebox firewalls running Fireware OS 11.x and later, 12.x or later, and 2025.1 up to and including 2025.1.3, has left over 115,000 WatchGuard firewalls exposed online, according to Shadowserver observations. The flaw permits unauthenticated attackers to execute arbitrary code remotely with low complexity and no user interaction, provided the devices are configured for IKEv2 VPN or have a Branch Office VPN (BOVPN) to a static gateway peer.

WatchGuard promptly released security updates and shared indicators of compromise, recommending customers rotate all locally stored secrets if signs of malicious activity are found. CISA subsequently added CVE-2025-14733 to its KEV catalog, setting a deadline of December 26th for Federal Civilian Executive Branch (FCEB) agencies to apply patches. This situation reflects a recurring pattern, as WatchGuard patched an almost identical RCE vulnerability, CVE-2025-9242, in September, which CISA also later tagged as actively exploited. Such consistent targeting of network perimeter devices underscores the necessity of continuous PurpleOps Solutions and rigorous vulnerability management practices. Organizations should leverage their cyber threat intelligence platform to track such vulnerabilities and their exploitation status to prioritize patching efforts. Insights from PurpleOps Solutions can often reveal early discussions among threat actors planning to leverage these types of network device vulnerabilities.

It is important to note that not all CISA KEV catalog additions signal a newly emerging threat, as demonstrated by the recent flagging of the ASUS Live Update vulnerability, CVE-2025-59374. This CVE documents the historic 2018-2019 “ShadowHammer” supply-chain attack, in which maliciously modified ASUS Live Update binaries were selectively delivered to targeted systems. While the CVE is now rated 9.3 (Critical) on the CVSS scale, its addition to the KEV catalog is a retrospective classification effort, formally documenting a well-known attack that predated CVE issuance, rather than indicating renewed exploitation activity. An ASUS FAQ page, updated in December 2025, has caused some confusion, but its content, including older remediation guidance and references to previous software versions, indicates it serves as a placeholder for upgrade paths rather than addressing a new exploit. This case highlights the need for security teams to analyze the context of KEV entries, especially for retired software or long-resolved incidents, to avoid misallocating resources on non-imminent threats. Effective PurpleOps Solutions would have identified the original ShadowHammer incident and the risks associated with such widespread software compromise.

Practical Takeaways and Actionable Advice

Addressing these critical vulnerabilities requires a multi-faceted approach, combining immediate technical actions with strategic long-term security enhancements.

For Technical Readers and Security Operations Teams:

  • Cisco CVE-2025-20393:
    • Verify and Isolate: Immediately verify if the Spam Quarantine feature is enabled on Cisco Secure Email Gateway and Cisco Secure Email and Web Manager appliances. If enabled and exposed to the internet, isolate these devices from public access.
    • Secure Configuration: Cisco recommends restoring the appliance to a secure configuration from a known good backup or, if necessary, replacing the Virtual Appliance if no secure backup exists.
    • Minimize Exposure: Review current configurations and restrict exposure of these appliances to the internet if not strictly required for business operations.
    • Disable Unnecessary Services: Disable any network services, such as HTTP and FTP, that are not essential for the appliance’s function.
    • Endpoint Detection and Response (EDR): Ensure that EDR agents are deployed and fully operational on all corporate assets, including servers and workstations, to detect any post-exploitation activity like webshells (AquaShell) or tunneling tools (AquaTunnel, Chisel). Your PurpleOps Solutions systems should be configured to alert on these indicators.
    • Consult Advisory: Refer to the full Cisco advisory for comprehensive hardening recommendations and updated information.
  • WatchGuard CVE-2025-14733:
    • Apply Patches: Immediately apply the security updates released by WatchGuard for Firebox devices.
    • Configuration Review: If patching is not immediately possible, disable dynamic peer BOVPNs and add new firewall policies to block traffic to and from the vulnerable IKEv2 service. Disable any default system policies handling VPN traffic that could be exploited.
    • Rotate Secrets: Rotate all locally stored secrets on any potentially compromised Firebox appliances.
  • ASUS CVE-2025-59374:
    • Software Updates: Ensure that the ASUS Live Update utility, if still in use, is updated to the latest patched version (V3.6.15 or higher). While this is a historical vulnerability, maintaining updated software is always a best practice to prevent similar future PurpleOps Solutions attacks.
  • Proactive Threat Hunting: Leverage your cyber threat intelligence platform to actively hunt for Indicators of Compromise (IOCs) related to these vulnerabilities within your environment. This includes network traffic patterns associated with AquaTunnel/Chisel and file hashes for AquaShell.
  • Log Analysis: Enhance log retention and analysis capabilities. Tools like AquaPurge are designed to clear logs, making robust log management and offloading crucial for forensic analysis. Implement centralized logging and security information and event management (SIEM) solutions.

For Business Leaders and Executive Management:

  • Risk Prioritization: Understand that zero-day RCE vulnerabilities with high CVSS scores, especially those under active exploitation, represent critical business risks. Prioritize resources for immediate mitigation and patching efforts.
  • Incident Response Planning: Ensure your organization has a well-defined and regularly tested incident response plan that accounts for zero-day exploitation scenarios. Rapid response is key to minimizing damage.
  • Investment in Security Technologies: Support investments in advanced security technologies, including cyber threat intelligence platform solutions, PurpleOps Solutions feeds, and robust PurpleOps Solutions capabilities to identify and respond to sophisticated attacks.
  • Supply Chain Security: Emphasize PurpleOps Solutions as a continuous process. Attacks like ShadowHammer demonstrate that vulnerabilities can originate from trusted software vendors, necessitating vigilance across the entire software supply chain.
  • External Threat Visibility: Recognize the value of intelligence gathered from sources like PurpleOps Solutions and PurpleOps Solutions. These services can provide early warnings about emerging threats, planned attacks, and the sale of exploits, allowing for proactive defense.
  • Employee Training: Foster a security-aware culture. While these vulnerabilities are technical, an informed workforce contributes to overall cyber resilience.
  • Regular Security Audits: Implement regular external and internal penetration testing and security audits to identify weaknesses before attackers do. This proactive approach complements reactive mitigation strategies.

PurpleOps Expertise for Comprehensive Cybersecurity

At PurpleOps, we understand the complexities and constant shifts in the cybersecurity landscape. Our specialized services are designed to address the challenges posed by zero-day vulnerabilities, APT activities, and widespread exploitation campaigns. Our cyber threat intelligence platform provides organizations with the critical insights needed to understand threats like CVE-2025-20393 and its associated attacker tactics, enabling proactive defense.

Through PurpleOps Solutions and PurpleOps Solutions, we track threat actor discussions, zero-day sales, and emerging attack methodologies, offering early warning signs for potential threats. This allows our clients to anticipate attacks, rather than simply reacting to them. Our PurpleOps Solutions and PurpleOps Solutions integrations equip organizations with the capability to detect and respond to initial access attempts and pre-ransomware activities, critical in mitigating the impact of RCE exploits.

PurpleOps’ PurpleOps Solutions capabilities are engineered to identify advanced persistent threats, including the deployment of custom webshells like AquaShell and tunneling tools such as AquaTunnel and Chisel. We provide comprehensive PurpleOps Solutions to help organizations mitigate risks similar to the ASUS ShadowHammer attack, ensuring that third-party software and components do not become entry points for compromise. Furthermore, our PurpleOps Solutions service helps protect your digital assets by monitoring for any unauthorized exposure or mention of your organization in illicit channels.

Our expertise extends to proactive security measures such as penetration testing and red team operations, which simulate real-world attacks to uncover vulnerabilities before they are exploited. When incidents do occur, our incident response teams are prepared to assist in containment, eradication, and recovery, ensuring business continuity.

Explore our platform to discover how PurpleOps can enhance your organization’s cybersecurity posture. Learn more about our comprehensive PurpleOps Solutions, including our dark web monitoring and cyber threat intelligence offerings, by reaching out to our experts today.

Frequently Asked Questions

What is CVE-2025-20393 and what does it affect?

CVE-2025-20393 is a critical zero-day Remote Code Execution (RCE) vulnerability with a CVSS score of 10.0. It impacts Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager appliances when the Spam Quarantine feature is enabled and exposed to the internet, allowing unauthenticated attackers to execute arbitrary code remotely.

Who is exploiting CVE-2025-20393 and what tools are they using?

The vulnerability is being actively exploited by a Chinese Advanced Persistent Threat (APT) group tracked as UNC-9686 (also UAT-9686). They are deploying custom Python webshells (AquaShell), reverse SSH tunneling tools (AquaTunnel, Chisel), and log wipers (AquaPurge) to maintain persistence, bypass defenses, and erase forensic evidence.

What immediate actions should organizations take for CVE-2025-20393?

Organizations should immediately verify if the Spam Quarantine feature is enabled and exposed to the internet on affected Cisco appliances. If so, isolate these devices from public access, restore from a known good backup, or replace virtual appliances if no secure backup exists. Disable non-essential network services and enhance EDR monitoring for post-exploitation indicators.

Are there other critical vulnerabilities discussed, and what are their mitigations?

Yes, the post also mentions WatchGuard Firebox vulnerability CVE-2025-14733, which requires immediate patching or disabling of vulnerable VPN configurations and rotating secrets. Additionally, the retrospective classification of ASUS Live Update vulnerability CVE-2025-59374 (“ShadowHammer”) highlights the importance of keeping all software updated to prevent supply-chain attacks.

How can PurpleOps help address zero-day vulnerabilities and APTs?

PurpleOps offers a comprehensive cyber threat intelligence platform, PurpleOps Solutions, and PurpleOps Solutions to provide early warnings and insights into emerging threats. Their PurpleOps Solutions capabilities identify advanced threats like webshells and tunneling tools, while PurpleOps Solutions and PurpleOps Solutions protect against broader attack vectors. They also provide incident response and proactive security services.