Cisco Secure Email Gateway CVSS 10.0 Zero-Day Via the Spam Filter

This week on IT SPARC Cast – CVE of the Week, John Barger and Lou Schmidt break down CVE-2025-20393, a CVSS 10.0 zero-day vulnerability affecting Cisco Secure Email Gateway (SEG) and related AsyncOS-based email security products.The flaw is actively exploited in the wild, remains unpatched, and—ironically—uses the spam filtering engine itself as the attack vector. With no user interaction required and evidence of nation-state activity, this vulnerability represents a worst-case scenario for organizations relying on Cisco’s email security stack.If you run Cisco Secure Email Gateway or Email Security Appliances, this is an emergency-level issue that demands immediate attention.⸻📌 Show Notes🚨 CVE of the Week: CVE-2025-20393•Severity: CVSS 10.0 (Critical)•Status: Actively exploited, no patch available•Vendor: Cisco🎯 Affected Products•Cisco Secure Email Gateway (SEG)•Cisco Email Security Appliance (ESA)•Cisco Secure Email and Web Manager (SEWM)•All affected systems run Cisco AsyncOS🔓 How the Exploit Works•Attackers deliver a specially crafted email that is processed before a spam verdict is reached•The payload is executed during email parsing, attachment handling, or content inspection•No user interaction required•The malicious email never needs to reach an inbox💥 Real-World Impact•Full remote code execution on the email gateway•Email interception and exfiltration (espionage risk)•Persistent access for follow-on attacks•Credential harvesting and downstream phishing using trusted infrastructure•Log wiping, making detection extremely difficult🌍 Threat Activity•Exploits observed as early as November 2025•Linked to Chinese state-aligned actors•Tracked under UAT-9686, associated with groups such as APT41 and UNC5174•Added to CISA’s Known Exploited Vulnerabilities (KEV) catalog🛡️ Mitigation Guidance (No Patch Available)•Immediately restrict and segment management interfaces•Tighten ACLs and allow lists•Treat SEG as Tier-Zero-adjacent infrastructure•If compromise is suspected: full system rebuild required•Assume persistence due to log tampering🧠 Commentary•The exploit weaponizes the very system designed to stop malicious email•Lack of a patch from a vendor of Cisco’s size raises serious concerns•For some organizations, this may prompt reevaluation of email security platforms altogether⸻🔚 Wrap-Up & Listener FeedbackWe want to thank listeners who continue to engage with the show and help shape the conversation:•GFABasic32 wrote:“Thanks for the emergency update on n8n. I love the balance of technical deep dives and high-level strategy. You guys make keeping up with CVEs actually entertaining.”•Dennis added:“I love the CVE of the Week. These episodes are like exposure therapy.”That’s exactly the goal—helping you face what’s happening in security so you can respond, not react.Have thoughts on this CVE or want us to cover another one? Reach out.⸻🔗 Social LinksIT SPARC Cast@ITSPARCCast on Xhttps://www.linkedin.com/company/sparc-sales/ on LinkedInJohn Barger@john_Video on Xhttps://www.linkedin.com/in/johnbarger/ on LinkedInLou Schmidt@loudoggeek on Xhttps://www.linkedin.com/in/louis-schmidt-b102446/ on LinkedIn Hosted on Acast. See acast.com/privacy for more information.