Cisco patches Secure Email Gateway zero-day exploited in attacks

CVE-2025-20393 is an improper input validation flaw (CWE-20) in Cisco Secure Email Gateway, Secure Email, AsyncOS software, and Web Manager appliances that lets attackers execute arbitrary commands with root privileges on the underlying operating system. The flaw is triggered when an affected appliance processes improperly validated input, though the CISA record does not specify the access vector or whether authentication is required. Successful exploitation yields full compromise of the appliance at the highest OS privilege level, which is significant because these devices sit in the email- and web-security path of enterprise networks. Organizations running these Cisco appliances are affected; CVSS has not yet been published and no public proof-of-concept is known. Exploitation is confirmed in the wild: CISA added the vulnerability to the KEV catalog on 2025-12-17, EPSS estimates a 29.9% chance of exploitation within 30 days (98th percentile), and ransomware use remains undetermined.

Do: Apply the mitigations or updates Cisco specifies in its advisory for CVE-2025-20393 without waiting for a CVSS score; the CISA KEV entry directs users to vendor mitigations, applicable BOD 22-01 cloud-service guidance, or discontinuing use if mitigations are unavailable. Because this record contains no fixed-release details, check the Cisco PSIRT advisory for the exact patched AsyncOS and Web Manager versions before planning the upgrade. In the meantime, review appliance logs and configurations for signs of unexpected command execution or changes, since active exploitation is confirmed and ransomware use is still unknown.

CVE-2026-20353 bundles multiple internally discovered vulnerabilities in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager, grouped under the CWE-664 pillar ('improper control of a resource through its lifetime'). Cisco has not published technical detail on the individual flaws, but the maximum CVSS 3.1 score of 9.8 (network vector, low complexity, no privileges or user interaction required) indicates that at least one of the grouped issues is remotely exploitable without authentication with high impact on confidentiality, integrity, and availability. Successful exploitation could allow an unauthenticated attacker to fully compromise an affected email gateway or management appliance, which sit in a privileged position on the mail path and hold quarantine stores, message logs, and configuration data. The flaws were found through Cisco's proactive internal review and are addressed in software hardening releases rather than in response to observed attacks. No public proof-of-concept exists and the CVE is not in the CISA Known Exploited Vulnerabilities catalog as of this writing.

Do: Upgrade Cisco Secure Email Gateway and Secure Email and Web Manager to the fixed software releases listed in the Cisco PSIRT advisory for CVE-2026-20353 — the fixed versions are not enumerated in the summary data, so verify against Cisco's advisory directly. Restrict management and web interface access to trusted internal networks or VPN, since these appliances are commonly exposed at the network edge. Review logs for anomalous behavior on the management interface and confirm quarantine data and configuration integrity after patching.

Cisco AsyncOS Software for Cisco Secure Email Gateway contains a SQL injection flaw (CWE-89) in its email parsing logic, caused by insufficient validation of message content. An unauthenticated, remote attacker can trigger it simply by sending a crafted email containing malicious SQL statements through an affected gateway, with no user interaction required. Successful exploitation allows arbitrary SQL execution that escalates to arbitrary operating-system command execution with root privileges, fully compromising the appliance and all mail flowing through it. Any organization running an affected version of Cisco Secure Email Gateway is impacted, and because these appliances sit on the inbound mail path they are inherently reachable over the network. There is no known public proof-of-concept, the flaw is not on the CISA KEV list, and no in-the-wild exploitation has been reported to date, though the CVSS 9.8 rating makes patching urgent.

Do: Upgrade to the fixed AsyncOS release listed in the corresponding Cisco PSIRT advisory as soon as possible, since the flaw is unauthenticated, requires no user interaction, and yields root. Until patched, apply any Cisco-documented workarounds and tightly restrict which hosts can submit mail to the gateway where operationally feasible. Review mail and system logs on these appliances for anomalies such as SQL errors in parsing, unexpected processes, or unexplained outbound connections that could indicate exploitation attempts.