Cisco Patches Critical Secure Email Gateway Zero-Day Exploited in Attacks

Cisco has warned customers to patch a critical zero-day vulnerability in its Secure Email Gateway (SEG) product, which threat actors have been actively exploiting in attacks. The flaw, which allows unauthenticated remote code execution as root, was disclosed in a security advisory released by Cisco in September 2026. According to the advisory, the vulnerability affects the SEG appliance and can be exploited by remote attackers to execute arbitrary commands with root privileges, potentially leading to full system compromise. Cisco has confirmed that the vulnerability has been exploited in the wild prior to the release of the patch. The company has released software updates to address the issue and strongly recommends that customers apply them immediately. The exact scope of the exploitation activity and the identity of the threat actors have not been independently verified, but the advisory indicates active exploitation. Organizations using Cisco Secure Email Gateway should prioritize patching and review their systems for signs of compromise.