Cisco Fixes Actively Exploited Zero-Day CVE-2026

CVE-2025-20393 is an improper input validation flaw (CWE-20) in Cisco Secure Email Gateway, Secure Email, AsyncOS software, and Web Manager appliances that lets attackers execute arbitrary commands with root privileges on the underlying operating system. The flaw is triggered when an affected appliance processes improperly validated input, though the CISA record does not specify the access vector or whether authentication is required. Successful exploitation yields full compromise of the appliance at the highest OS privilege level, which is significant because these devices sit in the email- and web-security path of enterprise networks. Organizations running these Cisco appliances are affected; CVSS has not yet been published and no public proof-of-concept is known. Exploitation is confirmed in the wild: CISA added the vulnerability to the KEV catalog on 2025-12-17, EPSS estimates a 29.9% chance of exploitation within 30 days (98th percentile), and ransomware use remains undetermined.

Do: Apply the mitigations or updates Cisco specifies in its advisory for CVE-2025-20393 without waiting for a CVSS score; the CISA KEV entry directs users to vendor mitigations, applicable BOD 22-01 cloud-service guidance, or discontinuing use if mitigations are unavailable. Because this record contains no fixed-release details, check the Cisco PSIRT advisory for the exact patched AsyncOS and Web Manager versions before planning the upgrade. In the meantime, review appliance logs and configurations for signs of unexpected command execution or changes, since active exploitation is confirmed and ransomware use is still unknown.

CVE-2026-20045 is an unauthenticated, remote command-execution flaw in Cisco Unified Communications Manager (including Session Management Edition), Unified CM IM & Presence Service, Unity Connection, and Webex Calling Dedicated Instance. It is caused by improper validation of user-supplied input in HTTP requests, and is triggered by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device. A successful exploit gives the attacker user-level access to the underlying operating system, which can then be elevated to root — the reason Cisco assigned a Critical Security Impact Rating on top of the 9.8 CVSS score. The affected products are core enterprise call-control and voicemail platforms used by large organizations, plus Cisco-hosted Webex Calling Dedicated Instances. The flaw is being exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-01-21 and news reports describe active probing, though no public proof-of-concept code is known and ransomware use is listed as unknown.

Do: Upgrade all five affected products (Unified CM, Unified CM SME, Unified CM IM&P, Unity Connection, and Webex Calling Dedicated Instance) to the fixed releases listed in Cisco's advisory, as this data does not specify version numbers. Until patched, restrict access to the web-based management interface to trusted management networks and monitor affected servers for suspicious HTTP request sequences and webshells. Federal agencies must apply vendor mitigations per CISA BOD 22-01 guidance or discontinue use, following the KEV listing of 2026-01-21.