Cisco finally fixes AsyncOS zero-day exploited since November

Cisco patched a maximum-severity AsyncOS zero-day (CVE-2025-20393) that was exploited in the wild against Secure Email Gateway and Secure Email and Web Manager appliances with internet-exposed Spam Quarantine, enabling arbitrary command execution as root. Cisco Talos links the intrusion activity since November 2025 to a Chinese-nexus APT tracked as UAT-9686, which deployed AquaShell persistence, AquaTunnel/Chisel reverse-SSH implants, and AquaPurge log-wiping; CISA added the vulnerability to its known exploited vulnerabilities catalog and ordered federal mitigation.