Cisco Warns of Active Attacks Exploiting Unpatched 0-Day in AsyncOS Email Security Appliances
A China-nexus advanced persistent threat (APT) actor nicknamed UAT-9686 has been actively using a maximum-severity zero-day vulnerabilities in Cisco AsyncOS software to attack Cisco Secure Email Gateway and Cisco Secure Email and Web Manager, according to a warning from Cisco.
The networking equipment firm claimed to have identified a small subset of appliances with specific ports accessible to the internet after learning about the infiltration effort on December 10, 2025. The number of impacted clients is presently unknown.
According to a Cisco advisory, this exploit gives the threat actors the ability to run arbitrary commands with root rights on the underlying operating system of an impacted equipment.
Evidence of a persistence technique implemented by the threat actors to re...