100+ Cisco Secure Email Devices Exposed to Zero‑Day Exploited in the Wild

Security researchers and Shadowserver Foundation have identified a critical zero-day (CVE-2025-20393) in Cisco Secure Email Gateway and Secure Email and Web Manager that is being actively exploited; at least 120 vulnerable devices were confirmed and more than 650 appliances are exposed online. Cisco has acknowledged the issue and published defensive guidance and temporary mitigations but no patch or timeline for a fix has been released, and organizations are urged to apply mitigations, restrict external access where feasible, and monitor for suspicious activity.