Cisco warns of unpatched AsyncOS zero-day exploited in attacks

Cisco Talos warns of a high-severity, actively exploited, unpatched AsyncOS zero-day (CVE-2025-20393) impacting Cisco Secure Email Gateway and Secure Email and Web Manager appliances with exposed Spam Quarantine; the attacker, tracked as UAT-9686 (Chinese-nexus APT), is observed deploying AquaShell persistence, reverse-tunnel implants (AquaTunnel, Chisel), and log-purging tools, with IOCs published and Cisco recommending restricting access, rebuilding compromised appliances, and following mitigation guidance.