Cisco customers hit by fresh wave of zero-day attacks from China-linked APT

Cisco disclosed active attacks since at least late November exploiting a critical zero-day (CVE-2025-20393) in AsyncOS for Secure Email Gateway and Secure Email and Web Manager that allows full command execution and persistent backdoors; Cisco attributes the activity to Chinese APT UAT-9686, no patch is available, and exploitation requires a publicly exposed spam quarantine feature. CISA added the vulnerability to its known exploited vulnerabilities catalog and Cisco recommends isolation or rebuilding of affected systems.