CVE-2025-20393Vulnerability
Cisco Multiple Products Improper Input Validation Vulnerability
Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .
Reported by 2 independent sources · first reported by The Hacker News · last reported
Last reported 10 days ago
CISA KEVAdded 17 Dec 2025
Fix due 24 Dec 2025
Used by ransomware: not knownCISA KEV catalogue
Fix due 24 Dec 2025
Used by ransomware: not knownCISA KEV catalogue
EPSS32.4%
higher than 98% of CVEsFIRST EPSS, as of 23 Oct 2026
higher than 98% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
2 reports, newest first · the exact sentence from each-
Cisco make-me-root email bug exploited as a 0-day by unknown crims“In January, attackers exploited another critical AsyncOS flaw, CVE-2025-20393, to break into Cisco SEG appliances and install persistence mechanisms.”
-
Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability“…loited since December, when a China-linked group that Cisco Talos tracks as UAT-9686 used a zero-day in the spam quarantine feature, CVE-2025-20393, that Cisco patched in January.”
Indicators reported together
named in the same reportsAlso named with it: CVE-2026-76461, CVE-2026-20353, CVE-2026-76443, CVE-2026-76440, CVE-2026-76441, CVE-2026-76442, CVE-2026-76519
Thanks — we review every report.