Cisco Patches Critical Email Flaw Exploited by Chinese Hackers

Cisco released security patches on Thursday for a critical vulnerability in its AsyncOS Software that has allowed Chinese-linked hackers to compromise email security appliances since at least late November 2025.

The flaw, identified as CVE-2025-20393, carries a maximum CVSS severity score of 10.0 and affects the Spam Quarantine feature in Cisco Secure Email Gateway and Secure Email and Web Manager products. It stems from insufficient validation of HTTP requests, enabling unauthenticated attackers to send crafted requests to vulnerable devices. Successful exploitation grants root privileges on the underlying operating system, potentially allowing full control of the appliance.

Cisco's Talos threat intelligence team detected the intrusions on December 10, 2025, during a customer support investigation. The company publicly disclosed the issue and its active exploitation a week later, on December 17. At that time, Talos attributed the attacks with moderate confidence to a threat actor tracked as UAT-9686, associated with a Chinese nexus. The group targeted a limited subset of appliances where the Spam Quarantine feature was enabled and exposed to the internet via specific ports,...