Cisco Patches Exploited Email Gateway File Write Bug
Cisco patches a second critical SEG zero-day in two months: unauthenticated attackers can write files to the OS. Exploitation is active. Patch immediately.
Marisol "Fuse" DelgadoCisco has patched a critical-severity zero-day in Secure Email Gateway (SEG) that attackers have been actively exploiting. The flaw allows an unauthenticated attacker to write arbitrary files to the appliance’s operating system, according to Cisco’s advisory as reported by BleepingComputer and The Hacker News. A CVE ID was not assigned in the initial advisory disclosure.
The vector is notable: this is a pre-authentication flaw in the email-handling path. Any message transiting the gateway is a potential delivery mechanism. The attacker does not need valid credentials or an existing foothold to trigger it.
What to do
Patch. Cisco released fixed versions of AsyncOS for Email and the only reliable remediation is applying the update. If your patching window is more than a few hours out, check Cisco’s advisory for any interim workarounds and assess whether direct internet exposure of your SEG instance can be reduced in the meantime.
This is an actively exploited zero-day, not a theoretical risk. CISA has historically added Cisco SEG flaws to the Known Exploited Vulnerabilities catalog within days of confirmed exploitation; treat this on the same timeline.
The second SEG zero-day this year
CVE-2026-76461 was a SQL injection in AsyncOS that also allowed unauthenticated OS command execution as root. CISA added it to KEV on September 14 with a three-day remediation deadline for federal agencies. That flaw carried a CVSS 9.8.
The flaw patched today is a separate vulnerability in the same product. Two unauthenticated, critical-severity, actively exploited zero-days in Cisco SEG in under two months points to continued offensive attention on this class of appliance.
Why this product is a persistent target
Email security gateways sit on the internet edge, processing every inbound message before it reaches internal infrastructure. An unauthenticated file write on one gives an attacker the ability to modify configuration, plant persistence, or stage further access into the mail environment. The position is high-value precisely because it is trusted by design to touch all inbound traffic.
The pattern extends beyond SEG. Cisco NX-OS picked up five CVSS 9.8 flaws in early October, and the SD-WAN Manager auth bypass landed in active exploitation last month. If you run Cisco infrastructure at the perimeter, your patching cadence for Cisco advisories should be immediate, not scheduled.
Check the Cisco advisory, apply the patch, and verify your SEG instances are not running the vulnerable release.
Found this useful? Share it.
