Cisco zero-day: the email gateway as an entry point

A current Cisco zero-day shows once again how quickly central security components can themselves become attack surface. Cisco email security appliances are being actively compromised worldwide, in many cases before organisations can react. What makes it particularly critical: no patch is available yet, while attackers are already pushing deep into production infrastructure.

Update of 20 October 2026: on 15 January 2026, two days after this article was published, Cisco released fixed AsyncOS versions. According to the Cisco advisory there is no workaround; affected appliances should be updated to the versions listed there. We have also aligned the details on attribution and on the preconditions of the attack with the publications from Cisco and Cisco Talos.

The attack in focus: CVE-2025-20393 in Cisco AsyncOS

At the centre is an as yet unpatched vulnerability in Cisco AsyncOS, the base software of several Cisco email security products. Attackers exploit faulty request handling to execute code with the highest system privileges, remotely and without authentication (CVE-2025-20393, CVSS 10.0).

The attacks specifically target publicly reachable appliances on which Spam Quarantine is enabled and reachable from the internet. According to Cisco, that is not the default setting. After successful exploitation, the attackers gain root access, install persistent backdoors and manipulate log files to cover their tracks.

Cisco Talos attributes the campaign with moderate confidence to a China-nexus APT group tracked as UAT-9686. According to current findings, the attacks were already running weeks before the public warning of 17 December 2025. Cisco says these are not broad scans but selective intrusions into a limited number of appliances.

Why immediate action is needed

A compromised email gateway is far more than a problem with a single system. It gives attackers access to sensitive communication, lets them bypass security controls and serves as a stable entry point for further steps inside the internal network.

Email gateways are among the most trusted systems in corporate networks. That is exactly what makes this zero-day so dangerous. Once such an instance is taken over, many downstream protection mechanisms lose their effect.

The current patch situation adds to the problem. Organisations cannot rely on their usual update processes and have to take other measures at short notice to reduce their exposure. Waiting risks data exfiltration, targeted espionage or a lasting compromise of internal processes.

On top of that comes a well-known structural gap: network and security appliances are often poorly monitored, fall outside regular scan routines and are treated as stable, set-and-forget systems. Attackers deliberately exploit exactly these assumptions.

In zero-day situations, visibility decides

blacklens.io helps organisations make critical systems and their real attack surface transparent, and alerts them proactively when needed.

Technology fingerprinting identifies the vendors and products behind the services and web applications reachable from the internet, as far as they can be recognised from the outside. This shows which systems are reachable from the outside in the first place. Their reachability reveals risky configuration patterns, such as openly accessible services or management interfaces. Continuous monitoring makes it possible to detect and prevent changes in exposure early, even without an available patch.

In addition, the blacklens.io early warning system matches external threat intelligence against your own infrastructure. Security teams get up-to-date information and can prioritise better: which systems are potentially affected, which are business-critical and where is action urgently needed? Especially during active exploitation, this assessment gives teams the certainty they need to decide and act.

What this zero-day shows

This Cisco zero-day makes clear how quickly central infrastructure can become an entry point. Modern attackers are not focusing on exotic systems but on widely used security components.

Patches remain important but are often not enough. What matters is the ability to monitor your own attack surface continuously, actively reduce exposure and assess critical systems realistically. Zero-days like this are no longer the exception but part of a new normal.

Organisations that invest early in transparency and exposure management are better prepared – not only for the next zero-day but for a threat landscape that keeps changing.