HighZero-Day

Cisco patches new Secure Email Gateway zero-day exploited in attacks

BleepingComputer·Source published 14 Oct 2026·1 min read

What happened?

Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges. [...]

Key details

Vulnerability stems from relative path traversal in AMP feature
Attackers send maliciously crafted email attachments to exploit the flaw
Affected devices have File Reputation service enabled and Content Scanner Tools earlier than 25.3.0.5525

Affected

SEG with File Reputation enabled and Content Scanner Tools earlier than 25.3.0.5525

Fixes and mitigations

Enable File Reputation under Mail Policies if not already assigned
Restrict appliance access and renew credentials after potential compromise

What to look for

Log message indicates suspected compromise found
Log message indicates security scan did not complete
Log message indicates no compromise indicator found

Summarised by SecOraLens from BleepingComputer. Always read the original source before acting. How SecOraLens verifies advisories.

Back to all advisories