Cisco fixes AsyncOS vulnerability exploited in zero-day attacks (CVE-2025-20393)

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cisco Addresses AsyncOS Zero-Day Exploited by Threat Actors Cisco has released fixes for CVE-2025-20393, a zero-day vulnerability in AsyncOS. This vulnerability has been exploited by suspected Chinese threat actors since November 2025, affecting users of Cisco's AsyncOS software. 3 sources 95