Cisco disclosed active exploitation of a critical vulnerability in Cisco Secure Email Gateway that allows unauthenticated attackers to write files to the appliance's operating system, according to a Wednesday advisory.
The attack works through email. An attacker sends a message containing a specially crafted attachment through the gateway. If successful, the exploit grants the ability to execute commands with root privileges on the affected appliance.
No prior authentication is required to launch this attack. Cisco Secure Email Gateway filters organizational email for spam and malware, making it a high-value target for attackers seeking to compromise mail infrastructure.
Cisco confirmed that exploitation is occurring in the wild. The company released the advisory describing the flaw and its active abuse but did not provide additional technical details about the vulnerability's origins or the scope of affected organizations.
The advisory indicates Cisco is tracking active exploitation attempts, signaling that defenders should prioritize patching. Email gateways sit at a network perimeter, making them attractive targets for initial compromise. Root-level command execution on such appliances could enable attackers to intercept, modify, or exfiltrate email traffic at scale.
Organizations running Cisco Secure Email Gateway should consult Cisco's advisory for patch availability and mitigation guidance. The combination of no authentication requirement, remote exploitability via email, and root-level access creates a severe risk profile that demands immediate attention from affected customers.