By Pierluigi Paganini
Publication Date: 2025-12-19 08:53:00
China-linked APT UAT-9686 is targeting Cisco Secure Email Gateway and Secure Email and Web Manager
December 19, 2025 
Cisco disclosed a critical zero-day (CVE-2025-20393) in Secure Email Gateway and Secure Email and Web Manager, actively exploited by a China-linked group.
Cisco disclosed a critical zero-day, tracked as CVE-2025-20393, in Secure Email Gateway and Secure Email/Web Manager, which is actively exploited by a China-linked threat group.
Cisco reported a December 10 campaign targeting certain Secure Email Gateway appliances with exposed ports, enabling attackers to run root-level commands and plant persistence mechanisms. Threat actors exploited a Remote Command Execution Vulnerability, tracked as CVE-2025-20393, in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager.
“On December 10, Cisco became aware of a new cyberattack campaign targeting a limited subset of…
