Patch now! Critical Cisco vulnerability exploited since December 2025

Network equipment supplier Cisco has finally released a security patch for Secure Email Gateway and Secure Email and Web Manager, closing a vulnerability that has been exploited since December of last year. If attacks are successful, attackers gain root privileges and take full control of instances.

The security vulnerability (CVE-2025-20393) is considered “ critical ” and is rated with the highest possible CVSS score of 10 out of 10. Cisco states that it observed an attack campaign as early as December 10, 2025 . At that time, there was no security update yet, and administrators had to protect their networks with a temporary solution. The network equipment supplier has now supplemented its warning message with details the vulnerability and information on versions secured against the attacks .

The vulnerability affects AsyncOS for Cisco Secure Email Gateway and Secure Email and Web Manager. In the revised warning message, the developers speak of a limited number of devices for which certain ports are publicly accessible. According to a report by Cisco Talos security researchers , the attacks are attributed to a Chinese APT group. The exact extent of the attacks is currently unclear. The network equipment supplier states that attackers establish a backdoor for further access on compromised systems.

To prevent this, administrators must immediately install one of the following AsyncOS versions secured against the described attack:

15.0.5-016 15.5.4-012 16.0.4-016

15.0.2-007 15.5.4-007 16.0.4-010

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.