Hundreds of Cisco customers are vulnerable to new Chinese hacking campaign, researchers say

Cisco disclosed a zero-day (CVE-2025-20393) being actively exploited by a Chinese government-backed hacking group against enterprise customers using Cisco Secure Email Gateway and Secure Email and Web Manager; security researchers (Shadowserver, Censys) estimate hundreds of exposed systems, there are no patches available, and Cisco recommends rebuilding affected appliances to remove attacker persistence, with Talos noting activity since at least late November 2025.