CVE · Exploited · On CISA KEV

CVE-2025-20393

Cisco Multiple Products Improper Input Validation Vulnerability

10.0: CVSS 3.1
1: story
DEC 17: added to KEV

Severity: 10.0 Critical · vendor score
Vendor: Cisco
Product: Multiple Products
Published: Dec 17, 2025
Added to KEV: Dec 17, 2025
KEV deadline: Dec 24, 2025
Ransomware use: Unknown
Weakness: CWE-20

What it is

Cisco Secure Email Gateway, Secure Email, AsyncOS Software, and Web Manager appliances contains an improper input validation vulnerability that allows threat actors to execute arbitrary commands with root privileges on the underlying operating system of an affected appliance.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑

DEC 17
Threat Actors Target Unpatched Cisco AsyncOS Zero-DayThreat actors are exploiting an unpatched zero-day vulnerability in Cisco AsyncOS software.LINDSEY O'DONNELL-WELCH · 2 MIN

Official references

4 sources

Registries

RegistryNVDScore, weakness and every reference RegistryCVE.orgThe official CVE record RegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisorysec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4