Loading story…
Cisco remediated two vulnerabilities in Cisco Secure Email Gateway, led by CVE-2024-20401, a critical flaw with a CVSS score of 9.8. An unauthenticated attacker can send a specially crafted email attachment to create root users, modify appliance configuration, execute arbitrary code, or trigger persistent denial of service.
Cisco also patched CVE-2024-20429 (CVSS 6.5), a server-side template injection vulnerability that allows an authenticated operator-level user to execute code remotely as root. Cisco reported no known exploitation when the advisory was issued; organizations should apply the available software updates and Cisco mitigations promptly.
Map this exposure pattern across your cloud, code, and identities.
1 event from the most recent confirmed update back to the earliest known activity.
Cisco released software updates for CVE-2024-20401 and CVE-2024-20429 in Cisco Secure Email Gateway. CVE-2024-20401 (CVSS 9.8) can allow an unauthenticated attacker using a crafted email attachment to gain root-level control, while CVE-2024-20429 (CVSS 6.5) enables authenticated operator-level code execution as root; Cisco said it was not aware of exploitation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco disclosed active exploitation of **CVE-2026-76461**, an SQL injection flaw affecting Cisco Secure Email Gateway deployments. The vulnerability affects unpatched releases of Cisco AsyncOS for Cisco Secure Email Gateway, Cisco Secure Email Gateway, and Cisco Secure Email and Web Manager. CISA added CVE-2026-76461 to its Known Exploited Vulnerabilities Catalog, while the Canadian Centre for Cyber Security issued advisory **AV26-921**. Cisco has released a September 2026 security-hardening update; administrators should identify affected appliances and management systems and apply Cisco’s prescribed fixed releases promptly.
Sep 14, 2026
Cisco released fixes for a maximum-severity vulnerability in *AsyncOS* (tracked as **CVE-2025-20393**, **CVSS 10.0**) affecting **Cisco Secure Email Gateway (SEG)** and **Secure Email and Web Manager (SEWM)** appliances. Cisco reported the issue was exploited as a zero-day in attacks against a limited subset of internet-exposed appliances, enabling attackers to execute arbitrary commands with **root** privileges on the underlying operating system. The flaw was attributed to insufficient HTTP request validation in the **Spam Quarantine** feature, allowing crafted HTTP requests to trigger root-level command execution. Cisco and Cisco Talos attributed the exploitation activity to **UAT-9686**, described as a China-linked threat group, with activity observed since at least late November 2025 and detected by Cisco on December 10. Cisco stated the intrusions included deployment of a **persistence mechanism** to maintain control over compromised appliances, and indicated that the released software updates both remediate the vulnerability and remove related persistence mechanisms; Cisco urged affected customers to upgrade to fixed releases per the updated advisory.
Jun 29, 2026
Multiple critical zero-day vulnerabilities have been exploited in Cisco security products, targeting both email security appliances and network firewalls. A China-linked APT, identified as UAT-9686, exploited a zero-day vulnerability (CVE-2025-20393) in Cisco email security appliances running AsyncOS, specifically when the Spam Quarantine feature is internet-accessible. This flaw allows attackers to gain root privileges, posing a severe risk to organizations relying on these appliances for email protection. In parallel, Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software have been targeted by a separate espionage campaign, linked to the ArcaneDoor threat actor, exploiting multiple zero-days (CVE-2025-20333, CVE-2025-20362, CVE-2025-20363) to achieve unauthenticated remote code execution and persistent access, even after system reboots or upgrades. These campaigns have prompted emergency directives from CISA and highlight the ongoing threat to perimeter network devices. Attackers have leveraged these vulnerabilities to establish persistent footholds, manipulate device memory, and potentially pivot deeper into victim networks. The vulnerabilities affecting ASA and FTD firewalls were publicly disclosed and patched, but the email security appliance zero-day remains unpatched, increasing the urgency for organizations to review their exposure and apply mitigations where possible.
Jun 29, 2026