Redhotcyber

Cisco Email Security Products Targeted in Zero-Day Campaign by China-Linked Actors

First seen 20 Dec 2025, 20:00 UTC • •67.2

Article Content

1 / 7

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

Cisco has confirmed a zero-day vulnerability (CVE-2025-20393) in its Secure Email appliances that is being exploited by actors linked to China. The attackers have deployed the Aquashell backdoor to establish persistence within affected systems.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 183d ago How this analysis works

Threat Graph

9 entities, 14 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Malware
Ransomware
Zero-day Exploit

Organization (1)

Cisco

Vulnerability (1)

CVE-2025-20393

Malware (1)

AquaShell

Affected Platform (3)

Cisco Secure Email
Cisco Secure Email And Web Manager
Cisco Secure Email Gateway

Relationships

AquaShell exploits CVE-2025-20393
CVE-2025-20393 targets Cisco Secure Email
CVE-2025-20393 targets Cisco Secure Email And Web Manager
CVE-2025-20393 targets Cisco Secure Email Gateway
AquaShell targets Cisco
Malware targets Cisco Secure Email
Malware targets Cisco Secure Email And Web Manager
Malware targets Cisco Secure Email Gateway
Ransomware targets Cisco Secure Email
Ransomware targets Cisco Secure Email And Web Manager
Ransomware targets Cisco Secure Email Gateway
Zero-day Exploit targets Cisco Secure Email
Zero-day Exploit targets Cisco Secure Email And Web Manager
Zero-day Exploit targets Cisco Secure Email Gateway

Following this threat?

Track AquaShell, Cisco and CVE-2025-20393 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical Cisco FMC Vulnerabilities Under Active Exploitation Cisco's Secure Firewall Management Center (FMC) Software has two critical vulnerabilities, CVE-2026-20079 and CVE-2026-20316, that are currently being exploited by state-sponsored and ransomware actors. CVE-2026-20079, rated 10.0 on the CVSS scale, allows unauthenticated remote attackers to bypass authentication and…

+5 88

Critical GitLab Vulnerabilities Exploited Soon After Patch Release On September 10, 2026, GitLab released versions 19.3.2, 19.2.6, and 19.1.8 to address critical vulnerabilities, including CVE-2026-85706, a path traversal flaw with a CVSS score of 10.0, allowing unauthenticated users to read arbitrary files from the server. Within hours of the patch, active exploitation attempts were…

+1 82

Cisco Email Security Products Targeted in Zero-Day Campaign by China-Linked Actors

Article Content

More articles in this cluster (6)

Threat Graph

Following this threat?

Extracted Entities (10)

Attack Types (3)

Companies (1)

Countries (1)

CVEs (1)

Malware (1)

Platforms (3)

Continue Reading