Skip to content
VulniPulse
Sign in
Advisory severityCritical10.0Cisco Exploited CISA KEV

Critical [CVE-2025-20393] Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability

This critical-severity Cisco advisory covers CVE-2025-20393 affecting Secure Email and Web Manager.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2025-20393 Source published Source updated

VulniPulse record published

CVE-2025-20393
Affected products & platforms
CiscoUnclassified
Open source advisory

Android app · Google Play

Monitor future Cisco CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

On December 10, Cisco became aware of a new cyberattack campaign targeting a limited subset of appliances with certain ports open to the internet that are running Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager.

This attack allows the threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance.

CISA Known Exploited Vulnerability

Listed:
Dec 17, 2025 · federal remediation due Dec 24, 2025
Required action:
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

KEV is a prioritization signal from CISA — remediation detail still comes from the vendor advisory.

Affected versions
  • Release 14.2 and earlier (first fixed: 15.0.5-016)
  • Release 15.0 (first fixed: 15.0.5-016)
  • Release 15.5 (first fixed: 15.5.4-012)
  • Release 16.0 (first fixed: 16.0.4-016)
  • Release 15.0 and earlier (first fixed: 15.0.2-007)
  • Release 15.5 (first fixed: 15.5.4-007)
  • Release 16.0 (first fixed: 16.0.4-010)

Official advisory · high-confidence parse· fetched 8 days ago·verify at source

Fixed versions
  • 15.0.5-016
  • 15.5.4-012
  • 16.0.4-016
  • 15.0.2-007
  • 15.5.4-007
  • 16.0.4-010

Official advisory · high-confidence parse· fetched 8 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • Upgrade to the first fixed release for your train per the Fixed Releases table in this advisory.
  • Release 14.2 and earlier: upgrade to 15.0.5-016.
  • Release 15.0: upgrade to 15.0.5-016.
  • Release 15.5: upgrade to 15.5.4-012.
  • Release 16.0: upgrade to 16.0.4-016.
  • Release 15.0 and earlier: upgrade to 15.0.2-007.
  • Release 15.5: upgrade to 15.5.4-007.
  • Release 16.0: upgrade to 16.0.4-010.
Workaround status
  • There are no workarounds identified that directly mitigate the risk concerning this attack campaign, but administrators can view and follow the guidance provided in the Recommendations section of this advisory.

Official advisory · high-confidence parse· fetched 8 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.