The flaw, tracked as CVE-2026-76461, carries a CVSS score of 9.8 out of a maximum of 10.0. According to Cisco, the issue stems from insufficient validation in the email parsing logic, which could allow an unauthenticated, remote attacker to exploit the affected system.

Organizations running Cisco Secure Email Gateway with vulnerable AsyncOS versions should treat this as a high-priority patching item given the active exploitation and the maximum-severity CVSS rating. Cisco has published guidance on the vulnerability, and administrators are advised to review the advisory and apply available fixes or mitigations as soon as possible.

• Affected product: Cisco Secure Email Gateway running AsyncOS Software
• Vulnerability type: insufficient validation in email parsing logic
• Attack vector: unauthenticated, remote
• Severity: CVSS 9.8
• Status: actively exploited in the wild

If you manage email security infrastructure, check your exposure now and confirm whether your version is affected before applying the vendor's remediation steps.

Source: The Hacker News

Has your organization already patched this, and if not, what's blocking the update?