Cisco Secure Email Gateway Critical Unauthenticated RCE Actively Exploited

Thu, 15 Oct 2026 15:35:13 +0000

Engineer — Act: Unauthenticated file write via crafted email attachment yielding root code execution on a common perimeter appliance is being actively exploited — patch Cisco Secure Email Gateway to Cisco’s fixed version immediately, and if patching cannot happen today, consider restricting inbound attachment processing or isolating the appliance.
SOC/IR — Act: Active exploitation of an edge email appliance means assume-breach posture: sweep Cisco SEG devices for unexpected OS file writes and anomalous root-level process execution since the advisory date, and check email logs for unusual attachments that passed through the gateway.
Leader — Act: Cisco Secure Email Gateway is widely deployed across enterprise environments; active exploitation of a perimeter email device handling sensitive communications warrants confirming whether your organization runs it and directing engineering to apply the emergency patch before end of day.

Email-Gateway on CuraSec