Loading story…
Cisco disclosed five remotely reachable, unauthenticated vulnerability groupings in Cisco Secure Email Gateway (AsyncOS) and Cisco Secure Email and Web Manager: CVE-2026-76440, CVE-2026-76441, CVE-2026-20353, CVE-2026-76442, and CVE-2026-76443. The most severe issue, CVE-2026-76443, stems from improper neutralization of input and could enable remote execution of crafted input; CVE-2026-76441 and CVE-2026-20353 are each rated CVSS 9.8 and can affect confidentiality, integrity, and availability without authentication or user interaction.
The flaws affect appliances regardless of configuration, and Cisco has provided no workarounds; organizations must upgrade to fixed releases. Cisco reported no known public exploit code or exploitation for the five newly disclosed vulnerabilities, but defenders should prioritize patching because the related AsyncOS flaw CVE-2026-76461 is under active exploitation and has been added to CISA's Known Exploited Vulnerabilities catalog.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
CISA added CVE-2026-76461, an AsyncOS email-parsing SQL injection flaw reported to enable unauthenticated root-level command execution through a crafted email, to its Known Exploited Vulnerabilities catalog due to active exploitation.
Cisco published a security-hardening release and disclosed five internally discovered, remotely reachable unauthenticated vulnerability groupings in Cisco Secure Email Gateway and Secure Email and Web Manager: CVE-2026-76440, CVE-2026-76441, CVE-2026-20353, CVE-2026-76442, and CVE-2026-76443. Cisco said no workarounds were available and remediation required upgrading to a fixed release.
Cisco patched a maximum-severity AsyncOS vulnerability after the zero-day exploitation that began in November 2025.
Zero-day exploitation of a maximum-severity vulnerability in Cisco's AsyncOS appliance family began in November 2025.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
threataft.com
Open sourcelabs.beazley.security
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco remediated two vulnerabilities in Cisco Secure Email Gateway, led by **CVE-2024-20401**, a critical flaw with a CVSS score of 9.8. An unauthenticated attacker can send a specially crafted email attachment to create root users, modify appliance configuration, execute arbitrary code, or trigger persistent denial of service. Cisco also patched **CVE-2024-20429** (CVSS 6.5), a server-side template injection vulnerability that allows an authenticated operator-level user to execute code remotely as root. Cisco reported no known exploitation when the advisory was issued; organizations should apply the available software updates and Cisco mitigations promptly.
Aug 31, 2026
Cisco released fixes for a maximum-severity vulnerability in *AsyncOS* (tracked as **CVE-2025-20393**, **CVSS 10.0**) affecting **Cisco Secure Email Gateway (SEG)** and **Secure Email and Web Manager (SEWM)** appliances. Cisco reported the issue was exploited as a zero-day in attacks against a limited subset of internet-exposed appliances, enabling attackers to execute arbitrary commands with **root** privileges on the underlying operating system. The flaw was attributed to insufficient HTTP request validation in the **Spam Quarantine** feature, allowing crafted HTTP requests to trigger root-level command execution. Cisco and Cisco Talos attributed the exploitation activity to **UAT-9686**, described as a China-linked threat group, with activity observed since at least late November 2025 and detected by Cisco on December 10. Cisco stated the intrusions included deployment of a **persistence mechanism** to maintain control over compromised appliances, and indicated that the released software updates both remediate the vulnerability and remove related persistence mechanisms; Cisco urged affected customers to upgrade to fixed releases per the updated advisory.
Jun 29, 2026
Multiple critical zero-day vulnerabilities have been exploited in Cisco security products, targeting both email security appliances and network firewalls. A China-linked APT, identified as UAT-9686, exploited a zero-day vulnerability (CVE-2025-20393) in Cisco email security appliances running AsyncOS, specifically when the Spam Quarantine feature is internet-accessible. This flaw allows attackers to gain root privileges, posing a severe risk to organizations relying on these appliances for email protection. In parallel, Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software have been targeted by a separate espionage campaign, linked to the ArcaneDoor threat actor, exploiting multiple zero-days (CVE-2025-20333, CVE-2025-20362, CVE-2025-20363) to achieve unauthenticated remote code execution and persistent access, even after system reboots or upgrades. These campaigns have prompted emergency directives from CISA and highlight the ongoing threat to perimeter network devices. Attackers have leveraged these vulnerabilities to establish persistent footholds, manipulate device memory, and potentially pivot deeper into victim networks. The vulnerabilities affecting ASA and FTD firewalls were publicly disclosed and patched, but the email security appliance zero-day remains unpatched, increasing the urgency for organizations to review their exposure and apply mitigations where possible.
Jun 29, 2026