Cisco Patches Actively Exploited Zero-Day in Secure Email Gateway
Root-level remote code execution flaw tracked as CVE-2026-23872
Key Takeaways
- Cisco has released patches for CVE-2026-23872, an actively exploited zero-day in Secure Email Gateway.
- The vulnerability allows remote, unauthenticated attackers to execute commands with root privileges.
- Exploitation was confirmed in the wild prior to the patch release.
- Users should apply the updates immediately to mitigate active exploitation risk.
Quick answers
- What happened?
- Cisco has released security updates to address a zero-day vulnerability in its Secure Email Gateway product that was actively exploited in the wild. The flaw allows remote, unauthenticated attackers to execute arbitrary commands with root privileges. Users are urged to apply the patches immediately to mitigate active exploitation risk.
- Which products are affected?
- Secure Email Gateway
- What should defenders do?
- Apply the latest Cisco Secure Email Gateway patches immediately. Monitor Cisco security advisories for version-specific update instructions. Segregate or disable SEG appliances if immediate patching is not possible.
Cisco has patched an actively exploited zero-day vulnerability in its Secure Email Gateway (SEG) product. The flaw, tracked as CVE-2026-23872, is a remote code execution vulnerability that allows unauthenticated, remote attackers to execute commands with root privileges. Exploitation of the vulnerability was reported in the wild prior to the release of the patch. Cisco's advisory urges all Secure Email Gateway users to update to the patched versions without delay to reduce the risk of compromise. The company has not disclosed detailed technical exploitation information, but confirmed that the vulnerability was being actively leveraged by threat actors before the patch became available.
Security Details
CVE-2026-23872 is a remote code execution vulnerability in Cisco Secure Email Gateway that allows unauthenticated, remote attackers to execute commands with root privileges. Exploitation was confirmed in the wild prior to the release of patches. Cisco has released security updates to address the flaw.
Affected products
Secure Email Gateway
Mitigation
Apply the latest Cisco Secure Email Gateway patches immediately. Monitor Cisco security advisories for version-specific update instructions. Segregate or disable SEG appliances if immediate patching is not possible.
Sources
BleepingComputer
Cisco patches new Secure Email Gateway zero-day exploited in attacks
Oct 14, 2026 · 17:29
Original link
Related Security News
Cisco Warns of Active Exploitation of Critical Vulnerability in Secure Email Gateway
Cisco has confirmed that a critical vulnerability in the Secure Email Gateway is being actively exploited in the wild. The flaw permits unauthenticated attackers to write files to the appliance's operating system and execute commands as root by sending a specially crafted email attachment through the gateway. The advisory was issued on October 14, 2026, and organizations are urged to apply security updates immediately.
