**China-linked APT UAT-9686 Abused Now Patched Maximum Severity AsyncOS Bug**

Cisco has patched a maximum severity AsyncOS flaw in Secure Email products, previously exploited as a zero-day by China-linked Advanced Persistent Threat (APT) group UAT-9686. The vulnerability, tracked as CVE-2025-20393 (CVSS score of 10.0), affects Secure Email Gateway and Email and Web Manager, allowing attackers to run root commands and install persistence.

Cisco detected attacks on exposed AsyncOS email appliances that enabled attackers to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance. The flaw stems from improper HTTP request validation in the Spam Quarantine feature, allowing attackers to send crafted requests and execute root-level commands on affected devices.

"On December 10, Cisco became aware of a new cyberattack campaign targeting a limited subset of appliances with certain ports open to the internet that are running Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager," reads the advisory. "This attack allows the threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance."

Cisco confirmed that threat actors deployed a persistence mechanism, dubbed "AquaShell," which allowed them to maintain control over compromised systems. The networking giant also confirmed attacks targeted Secure Email Gateway and Secure Email and Web Manager appliances running vulnerable AsyncOS with Spam Quarantine enabled and exposed online.

It's worth noting that the feature is disabled by default on Cisco Secure Email Cloud and Secure Web products, which are not affected by this vulnerability. However, analysis shows that only appliances running non-standard configurations have been compromised, suggesting misconfigurations play a key role in exposure.

**The Attack Mechanism**

AquaShell is a lightweight Python backdoor embedded in a Cisco AsyncOS web server file that executes encoded shell commands sent via unauthenticated HTTP POST requests. It's installed by decoding a data blob into a modified index.py. Attackers also used AquaPurge to erase traces by removing specific keywords from log files.

AquaTunnel, a Go-based ReverseSSH variant, allows attackers to establish persistent reverse SSH access to attacker servers, while Chisel enables HTTP-based tunneling to proxy traffic and pivot from compromised appliances into internal networks.

**The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has Added the Zero-Day Flaw to its Known Exploited Vulnerabilities Catalog**

In December, CISA added the zero-day flaw to its Known Exploited Vulnerabilities catalog, highlighting the severity of this vulnerability. Cisco's Talos security experts discovered the exploitation of CVE-2025-20393, and the company has since patched the vulnerability.

**Recommendations for Users**

Cisco advises users to take immediate action to remediate this vulnerability by upgrading their AsyncOS software or disabling the Spam Quarantine feature if it's not in use. Additionally, users should review their appliance configurations to ensure they are following best practices and not exposing unnecessary ports to the internet.

As always, we remind our readers that staying informed and vigilant is key to preventing cyber attacks. By keeping up-to-date with the latest security news and patching vulnerabilities promptly, organizations can reduce their risk of being compromised by APT groups like UAT-9686.

**Follow me on Twitter:** @securityaffairs **Facebook**: [link] **Mastodon**: [link]