Cisco AsyncOS Remote Code Execution Vulnerability

A vulnerability was identified in Cisco AsyncOS. A remote attacker could exploit this vulnerability to trigger remote code execution on the targeted system.

Note:

CVE-2025-20393 is being exploited in the wild. Cisco aware of a new cyberattack campaign targeting a limited subset of appliances with certain ports open to the internet that are running Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. This attack allows the threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance.

Hence, the risk level is rated as High Risk.