Cisco AsyncOS RCE actively exploited in wild
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Critical remote code execution in Cisco Secure Email Gateway and Web Manager AsyncOS is being actively exploited; no patch available.
Cisco disclosed a critical, previously unknown vulnerability in AsyncOS affecting Cisco Secure Email Gateway and Cisco Secure Email and Web Manager appliances. CVE-2025-20393 permits unauthenticated remote code execution with root privileges on affected systems. Cisco confirmed active exploitation beginning December 10, 2025, targeting a limited subset of appliances with certain ports exposed to the internet. The vulnerability is triggered when both the Spam Quarantine feature is configured and exposed to the internet—a non-default configuration, though deployment guidance does not require direct internet exposure. Threat actors have established persistence mechanisms on compromised appliances.
No patch is available at the time of disclosure. CISA added CVE-2025-20393 to its Known Exploited Vulnerabilities catalog, elevating urgency. Cisco recommends immediate isolation of affected appliances and access control hardening. If compromise is suspected, appliance rebuilding is currently the only viable option to remove the persistence mechanism. Organizations running these products should immediately audit network exposure of the Spam Quarantine and web management ports and restrict internet-facing access.
Mentioned in this report
Detection guidance
Internet Source Connecting to Cisco Spam Quarantine Default Ports
Flags allowed inbound connections from public IPs to TCP 82/83, the default Cisco AsyncOS Spam Quarantine ports, which indicates exposure to CVE-2025-20393 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Internet Source Connecting to Cisco Spam Quarantine Default Ports
description: Detects allowed inbound connections from non-private source addresses
to TCP ports 82 and 83, the default Cisco AsyncOS Spam Quarantine HTTP/HTTPS ports.
CVE-2025-20393 is exploited remotely via an internet-exposed Spam Quarantine, so
this surfaces exposure and possible exploitation attempts. Scope the rule to Cisco
Secure Email Gateway and Email and Web Manager appliance addresses in the SIEM to
cut noise.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: firewall
detection:
selection:
dst_port:
- 82
- 83
action:
- allowed
- allow
- accept
- permitted
filter_internal_sources:
src_ip|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 127.0.0.0/8
condition: selection and not filter_internal_sources
falsepositives:
- Legitimate end users reaching a deliberately internet-published Spam Quarantine
portal to review quarantined mail
- Unrelated internet-facing services that listen on TCP 82 or 83 when the rule is
not scoped to the appliance addresses
level: low
id: ea9dd52b-b219-55b6-ad24-aa0e13c59649
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-cisco-asyncos-could-allow-for-remote-code-execution_2025-117
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-cisco-asyncos-could-allow-for-remote-code-execution_2025-117
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs