---
id: "CVE-2025-20393"
kind: "vulnerability"
aliases: ["CVE-2025-20393"]
title: "A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco\u2026"
severity: "critical"
cvss: 10.0
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Cisco Multiple Products", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "cisco asyncos", "fixed": ["15.0.5-016"], "affected": "< 15.0.5-016", "ecosystem": "vendor"}, {"name": "cisco asyncos", "fixed": ["15.5.4-012"], "affected": ">= 15.5, < 15.5.4-012", "ecosystem": "vendor"}, {"name": "cisco asyncos", "fixed": ["16.0.4-016"], "affected": ">= 16.0, < 16.0.4-016", "ecosystem": "vendor"}, {"name": "cisco asyncos", "fixed": ["15.0.2-007"], "affected": "< 15.0.2-007", "ecosystem": "vendor"}, {"name": "cisco asyncos", "fixed": ["15.5.4-007"], "affected": ">= 15.5, < 15.5.4-007", "ecosystem": "vendor"}, {"name": "cisco asyncos", "fixed": ["16.0.4-010"], "affected": ">= 16.0, < 16.0.4-010", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cisco", "email-security-appliance", "exploited", "infrastructure", "secure-email-gateway", "self-hosted"]
not_affected_if: ["cloud-hosted-only"]
published_at: "2025-12-17T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T23:44:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-20393", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20393", "first_seen_at": "2026-10-23T23:44:51+00:00"}]
---

# A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco…

Cisco Secure Email Gateway, Secure Email, AsyncOS and Web Manager appliances have an input validation flaw that lets an attacker run arbitrary commands. The commands run as root on the underlying appliance OS, and CISA lists it as actively exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Cisco Multiple Products affected ? fixed ?
- vendor:cisco asyncos affected < 15.0.5-016 fixed 15.0.5-016
- vendor:cisco asyncos affected >= 15.5, < 15.5.4-012 fixed 15.5.4-012
- vendor:cisco asyncos affected >= 16.0, < 16.0.4-016 fixed 16.0.4-016
- vendor:cisco asyncos affected < 15.0.2-007 fixed 15.0.2-007
- vendor:cisco asyncos affected >= 15.5, < 15.5.4-007 fixed 15.5.4-007
- vendor:cisco asyncos affected >= 16.0, < 16.0.4-010 fixed 16.0.4-010

## Fix

Apply the mitigations in Cisco's vendor advisory; if none are available, CISA says to discontinue use of the product. Affected and fixed versions: unknown from these sources.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-20393
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-20393

## From the sources

A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges.

This vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with&nbsp;root privileges.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_