Reference page — cumulative record through Wednesday, October 7, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2025-20393

CVE-2025-20393CRITICAL

Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  H  H  H   10.0   .3239   98.3   YES

AFFECTED
  Product                             Versions      Fixed
  Cisco Secure Email                  14.0.0-698 –  —
  Cisco Secure Email and Web Manager  13.6.2-023 –  —

TIMELINE
  Oct 10  Reserved by cisco
  Dec 17  Added to CISA KEV, remediation due 2025-12-24
  Dec 17  Published (CNA: cisco)

CWE-20 · CNA: cisco · CVSS v3.1 · 2 references · KEV due December 24, 2025

Description

A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root privileges. This vulnerability is due to insufficient validation of HTTP requests by the Spam Quarantine feature. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
October 10, 2024	Reserved	Reserved by cisco
December 17, 2025	KEV ADDED	Added to CISA KEV, remediation due 2025-12-24
December 17, 2025	Published	Published (CNA: cisco)

Affected

Affected products and packages — 2 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Cisco	Cisco Secure Email	—	14.0.0-698	—
Cisco	Cisco Secure Email and Web Manager	—	13.6.2-023	—

Weaknesses

CWE-20

References (2)

Authoritative record: CVE-2025-20393 at cve.org

Vendors: cisco

Weaknesses: CWE-20

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-20393 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, October 7, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.