How severe is CVE-2025-20393?

CVE-2025-20393 has a CVSS 3.x base score of 10.0, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2025-20393 being actively exploited?

Yes. CVE-2025-20393 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2025-12-17, which means active exploitation has been confirmed. It should be prioritised for remediation.

What products are affected by CVE-2025-20393?

CVE-2025-20393 affects Cisco Asyncos. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-20393?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.

Does CVE-2025-20393 have an EU (EUVD) identifier?

Yes. CVE-2025-20393 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-203911. It is also flagged as exploited in the EUVD (since 2025-12-17).

When was CVE-2025-20393 published?

CVE-2025-20393 was published on 2025-12-17 and last updated on 2026-06-17.

CVE-2025-20393

CVE-2025-20393 is a critical-severity vulnerability in Cisco Asyncos with a CVSS 3.x base score of 10.0. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been exploited in the wild (added 2025-12-17). The underlying weakness is classified as CWE-20.

Key facts

Severity: Critical (CVSS 3.x base score 10.0)
EPSS exploit prediction: 29% (98th percentile)
Actively exploited: Yes — listed in CISA KEV (added 2025-12-17)
EU (EUVD) id: EUVD-2025-203911
EU exploitation: Flagged exploited in the ENISA EU Vulnerability Database (since 2025-12-17)
Weakness: CWE-20
Affected product: Cisco Asyncos
Published: 2025-12-17
Last modified: 2026-06-17

Description

A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges. This vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.

Frequently asked questions

What is CVE-2025-20393?: A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges. This vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.
How severe is CVE-2025-20393?: CVE-2025-20393 has a CVSS 3.x base score of 10.0, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2025-20393 being actively exploited?: Yes. CVE-2025-20393 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2025-12-17, which means active exploitation has been confirmed. It should be prioritised for remediation.
What products are affected by CVE-2025-20393?: CVE-2025-20393 affects Cisco Asyncos. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-20393?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.
Does CVE-2025-20393 have an EU (EUVD) identifier?: Yes. CVE-2025-20393 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-203911. It is also flagged as exploited in the EUVD (since 2025-12-17).
When was CVE-2025-20393 published?: CVE-2025-20393 was published on 2025-12-17 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:o:cisco:asyncos:*:*:*:*:*:*:*:*

More vulnerabilities in Cisco Asyncos

CVE-2024-20435 — High (CVSS 8.8): A vulnerability in the CLI of Cisco AsyncOS for Secure Web Appliance could allow an authenticated, local attacker to…
CVE-2019-15956 — High (CVSS 8.8): A vulnerability in the web management interface of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could…
CVE-2021-34698 — High (CVSS 8.6): A vulnerability in the proxy service of Cisco AsyncOS for Cisco Web Security Appliance (WSA) could allow an…
CVE-2019-1947 — High (CVSS 8.6): A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliance…
CVE-2019-1886 — High (CVSS 8.6): A vulnerability in the HTTPS decryption feature of Cisco Web Security Appliance (WSA) could allow an unauthenticated,…
CVE-2018-15460 — High (CVSS 8.6): A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances…

All CVEs affecting Cisco Asyncos →

Other CWE-20 (Improper Input Validation) vulnerabilities

CVE-2026-48316 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
CVE-2026-48281 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
CVE-2026-48277 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
CVE-2026-48055 — Critical (CVSS 10.0): Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and…
CVE-2026-34910 — Critical (CVSS 10.0): A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS…
CVE-2026-33587 — Critical (CVSS 10.0): Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and…

Browse all CWE-20 (Improper Input Validation) vulnerabilities →