Main Vulnerability Database Vulnerabilities #VU120181

Input validation error in Cisco Secure Email and Web Manager and Secure Email Gateway - CVE-2025-20393

Published: December 17, 2025 / Updated: January 16, 2026

Vulnerability identifier: #VU120181

CSH Severity: Critical

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-20393

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

Vulnerability details

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input. A remote non-authenticated attacker can send specially crafted packets to the device and execute arbitrary code with root privileges.

Note, the vulnerability is being actively exploited in the wild.

Affected software

Cisco Secure Email and Web Manager
Secure Email Gateway

How to mitigate CVE-2025-20393

Install update from vendor's website.

Cisco Secure Email and Web Manager - addressed in versions 15.0.2-007, 15.5.4-007, 16.0.4-010
Secure Email Gateway - addressed in versions 15.0.5-016, 15.5.4-012, 16.0.4-016

External References

Related Security Bulletins