Critical Unauthenticated RCE in Cisco Secure Email Gateway

Cisco remediated two vulnerabilities in Cisco Secure Email Gateway, led by CVE-2024-20401, a critical flaw with a CVSS score of 9.8. An unauthenticated attacker can send a specially crafted email attachment to create root users, modify appliance configuration, execute arbitrary code, or trigger persistent denial of service.

Cisco also patched CVE-2024-20429 (CVSS 6.5), a server-side template injection vulnerability that allows an authenticated operator-level user to execute code remotely as root. Cisco reported no known exploitation when the advisory was issued; organizations should apply the available software updates and Cisco mitigations promptly.