CVE-2025-20393criticalunder attackCWE-20

CVE-2025-20393: critical vulnerability in Cisco Secure Email

Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability

Published · Updated

Follow this CVE+ Monitor Cisco Secure Email+ Monitor Cisco Secure Email and Web Manager

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

92Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 10epss 32%
from disclosure to weapon1 day
Published on NVDDec 17
1st PoC+1d
CISA KEVDec 17
Action required by CISAfederal deadline: 2025-12-24

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

A flaw in Cisco's email security appliances allows an attacker to send a specially crafted web request and take complete control of the device, running any command as the administrator. This is critical because these devices protect entire organizations' email.

Technical detail

Insufficient HTTP request validation in the Spam Quarantine feature enables unauthenticated remote command execution with root privileges. An attacker sends a malicious HTTP request to the affected appliance; no authentication or special conditions are required. Successful exploitation grants complete system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges. This vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Cisco · Cisco Secure EmailCisco · Cisco Secure Email and Web Manager
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Cisco Secure Email

In the same product, most dangerous first.

CVE-2026-76461CRITICALCisco Secure Email Gateway SQL Injection VulnerabilityEPSS 29.5%KEVCVE-2026-76519CRITICALCisco Secure Email Gateway Arbitrary File Write VulnerabilityEPSS 2.2%KEVCVE-2026-76443CRITICALCisco Secure Email Gateway Security Hardening ReleaseEPSS 2.4%CVE-2024-20401CRITICALCVE-2024-20401EPSS 2.3%CVE-2023-20009MEDIUMCVE-2023-20009EPSS 2.2%CVE-2022-20942MEDIUMCVE-2022-20942EPSS 1.1%