CVE-2025-20393

Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability

Exploited in the wild. In CISA KEV since 2025‑12‑17. A vendor fix is available.

CVSS 3.110.0Critical EPSS percentile98th32% chance in 30 days CISA KEVListedsince 2025-12-17, due 2025-12-24
Public exploit: 0 sources FixVendor fixNo build named by the sources

Published 2025-12-17Updated 2026-01-16Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether your Cisco Secure Email Gateway / Cisco Secure Email and Web Manager has the Spam Quarantine feature enabled.
Verify the device software version is affected (compare your AsyncOS / Secure Email and Web Manager version against the fixed release 15.0.5-016).
Upgrade to the fixed version: asyncos fixed in 15.0.5-016.
If you cannot patch immediately, apply the vendor’s compensating/mitigation guidance from Cisco’s advisory and limit exposure of the affected interfaces/paths per vendor instructions until you can upgrade.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges. This vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.

In plain language

Written by AI from the record

CVE-2025-20393 is a critical remote “break-in” flaw in Cisco Secure Email Gateway / Secure Email and Web Manager where an attacker can run commands on the server without logging in—if your system has Spam Quarantine enabled, you should treat this as urgent.

CVE-2025-20393 is a Remote Command Execution vulnerability (CWE-20) in the Spam Quarantine functionality of Cisco Secure Email Gateway / Cisco Secure Email and Web Manager; an unauthenticated attacker can send a crafted HTTP request to bypass request checks and execute arbitrary system commands with root privileges, enabling full system compromise. It is listed in CISA KEV with a mitigation due date of 2025-12-24.

If you're affected

Full server takeover
Email system compromise
Data theft or tampering
Service disruption and outages

What is it

This is a serious flaw in your email security appliance’s “Spam Quarantine” feature. If it’s enabled, a remote attacker can send a specially made request and get the server to run commands as the administrator (root), which effectively means they can take full control of the device. Think of it like leaving your building’s control panel unlocked, but with a hidden trick that lets someone not only enter—rather, they can issue commands that control everything inside.

Who is affected

This matters if you run Cisco Secure Email Gateway or Cisco Secure Email and Web Manager (including the virtual appliance versions) and your configuration has the Spam Quarantine feature enabled. The vulnerability is remotely reachable and does not require login or user action, so exposure depends mainly on whether the feature is turned on and reachable by attackers in your network setup. If your internet-facing setup (or other reachable path) allows access to the vulnerable Spam Quarantine endpoint, you should assume risk and act immediately.

How urgent is it

This is RED because CISA added CVE-2025-20393 to its KEV catalog and set a remediation due date of 2025-12-24, and the flaw enables unauthenticated remote root command execution. That combination means attackers have a clear path to take over affected systems, so you should treat this as an active, time-critical patch window rather than a waiting issue.

What to do — in detail

Confirm exposure

Identify which product you use: Cisco Secure Email Gateway and/or Cisco Secure Email and Web Manager (including their virtual appliance variants), and record your current software version.
In your configuration, confirm whether the Spam Quarantine feature is enabled.
Confirm whether the device is reachable from untrusted networks (commonly the internet) on the interfaces/ports used for the web-based components that serve Spam Quarantine requests. If your environment is segmented, still verify that untrusted users cannot reach the vulnerable endpoint.

Patch / upgrade (primary fix)

Upgrade Cisco AsyncOS to the fixed release: 15.0.5-016.
After upgrading, re-check that Spam Quarantine is functioning normally and that the device reports the expected version.

If you cannot patch immediately

Apply Cisco’s compensating mitigations as documented in the Cisco Security Advisory linked in the remediation info provided (including guidance about using different network paths/ports for mail processing vs. administration for the vulnerable components). Keep the mitigation in place until the fixed version is deployed.

Deadline

CISA KEV remediation due date: 2025-12-24.

What to monitor after changes

Review management and web access logs for unusual requests targeting Spam Quarantine behavior, including unexpected HTTP request patterns from external IPs.
Check for unexpected configuration changes or service restarts, and verify that no persistence mechanisms were added (if your team tracks configuration integrity/changes).
If you observe indicators of compromise, isolate the appliance and escalate incident response to your security team/vendor.

Technical context

CVE-2025-20393 is a critical Remote Command Execution issue (CWE-20) with root privileges. The mechanism is insufficient validation of HTTP requests in the Spam Quarantine feature: an unauthenticated remote attacker can send a crafted HTTP request that bypasses security checks, resulting in arbitrary command execution on the underlying system as root.

Exploitation status: It is listed in CISA KEV (added 2025-12-17) with a remediation due date of 2025-12-24, indicating it should be treated as actively relevant. Public exploit availability is noted. While news reporting confirms active exploitation for a different, related Cisco Secure Email Gateway zero-day (CVE-2026-76461), the findings provided do not claim active exploitation specifically for CVE-2025-20393; however, the KEV listing and public exploit availability elevate urgency.

Affected conditions: Spam Quarantine must be enabled on the target. No authentication and no user interaction are required.

Fixed version: asyncos fixed in 15.0.5-016.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS98th

Public exploit

CISA KEV

Listed as exploited in the wild since 2025-12-17.

US federal agencies must remediate by 2025-12-24.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Public exploits

0 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

32% chance of exploitation activity in the next 30 days, which ranks it in the 98th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 190 days, from the signal feeds we watch.

2026-06-25OpenVAS check added
2026-06-22EPSS band changelow → moderate
2026-01-16Patch availablerecord updated
2025-12-17Added to CISA KEVpublished, weakness classified, att&ck mapped

Affected products

Cisco Systems Inc.commercial · USaka cisco, cisco systems

And 2 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Scored 10.0 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable