Blog.Talosintelligence

Cisco Fixes Critical AsyncOS Vulnerability Under Attack

First seen 16 Jan 2026, 03:59 UTC • Blog.Talosintelligence

+4 •95.8

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Cisco has addressed a maximum-severity vulnerability in AsyncOS, tracked as CVE-2025-20393, which has been actively exploited for at least a month. The flaw affects Secure Email Gateway (SEG) and Secure Email and Web Manager (SEWM) appliances, allowing attackers to execute arbitrary commands with root privileges. Cisco first detected attacks targeting these appliances on December 10.

How this analysis works

Attack Flow

17 entities, 47 inferred relationships (STIX 2.1).

Threat Actor (3)

APT41
Uat-9686
Unc5174

Technique (2)

Malware
Zero-day Exploit

Organization (3)

CISA
Cisco
Cisco Talos

Vulnerability (1)

CVE-2025-20393

Malware (4)

AquaPurge
AquaShell
AquaTunnel
Chisel

Affected Platform (4)

AsyncOS
Cisco Secure Email Gateway
Secure Email And Web Manager
Secure Email Gateway

Relationships

APT41 uses AquaPurge
APT41 uses AquaShell
APT41 uses AquaTunnel
APT41 uses Chisel
Uat-9686 uses AquaPurge
Uat-9686 uses AquaShell
Uat-9686 uses AquaTunnel
Uat-9686 uses Chisel
Unc5174 uses AquaPurge
Unc5174 uses AquaShell
Unc5174 uses AquaTunnel
Unc5174 uses Chisel
APT41 uses Malware
APT41 uses Zero-day Exploit
Uat-9686 uses Malware
Uat-9686 uses Zero-day Exploit
Unc5174 uses Malware
Unc5174 uses Zero-day Exploit
AquaPurge exploits CVE-2025-20393
AquaShell exploits CVE-2025-20393
AquaTunnel exploits CVE-2025-20393
Chisel exploits CVE-2025-20393
CVE-2025-20393 targets AsyncOS
CVE-2025-20393 targets Cisco Secure Email Gateway
CVE-2025-20393 targets Secure Email And Web Manager
CVE-2025-20393 targets Secure Email Gateway
APT41 targets CISA
APT41 targets Cisco
APT41 targets Cisco Talos
Uat-9686 targets CISA
Uat-9686 targets Cisco
Uat-9686 targets Cisco Talos
Unc5174 targets CISA
Unc5174 targets Cisco
Unc5174 targets Cisco Talos
AquaPurge targets CISA
AquaPurge targets Cisco
AquaPurge targets Cisco Talos
AquaShell targets CISA
AquaShell targets Cisco
AquaShell targets Cisco Talos
AquaTunnel targets CISA
AquaTunnel targets Cisco
AquaTunnel targets Cisco Talos
Chisel targets CISA
Chisel targets Cisco
Chisel targets Cisco Talos

Continue Reading

Persistent Firestarter Malware Targets Cisco Firepower Devices in US Agencies MuddyWater Targets U.S. Entities Amid Geopolitical Tensions APT41 Exploits Cloud Services with New Zero-Detection ELF Backdoor Kimsuky Exploits South Korean Groupware Vendors with New Gomir Variants FamousSparrow APT Expands Targeting to Azerbaijani Energy Sector AI-Generated Exploits Target Siemens PLCs in Critical Infrastructure

Cisco Fixes Critical AsyncOS Vulnerability Under Attack

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading