A crafted email is already getting root on unpatched Cisco Secure Email Gateways

The chain is short. A message reaches the gateway, AsyncOS parses it, and attacker-controlled content from that message reaches SQL without sufficient validation ^[1]. Cisco's Monday advisory puts the end state plainly: "A successful exploit could allow the attacker to execute arbitrary SQL statements, leading to command execution with root privileges on the underlying operating system" ^[3]. The attacker does not need to log in, and no user has to click. The appliance is built to accept mail from strangers ^[1].

Detection starts with a grep. Cisco tells administrators to search the IronPort text mail logs with `grep -i "COPY.*TO PROGRAM"`, treat any output line as possible malicious activity, and repeat the check on every member of a cluster ^[8].

In the same advisory Cisco said: "Because of this level of access, evidence of exploitation and indicators of compromise may be removed or hidden by the threat actors" ^[10]. So a grep that comes back empty does not clear the appliance. Cisco's own recommendation is to work from records the appliance does not control, cross-checking network and firewall logs for unexpected uploads from the device to external IP addresses or downloads from malicious ones ^[11].

Configuration will not help here, and the only mitigation Cisco lists is a new image, so remediation means upgrading a box that carries production mail inline ^[16]. For federal civilian agencies the clock is set ^[12]. Everyone else picks their own date while the exploitation continues ^[2].

The Cisco advisory landed days after Arctic Wolf reported separate activity against a different edge appliance: two sustained waves of credential attacks against internet-facing Fortinet VPNs, running from August 26 through August 28, 2026, across multiple U.S. customer environments and generating tens of millions of authentication failures ^[13]. Security researcher Kyle Siddall said the attackers had assembled the account list in advance: "This targeted identity selection, rather than generic username spraying, indicates access to previously collected or enumerated identity information" ^[14]. In one case a successful Fortinet VPN authentication from the IP address 158.94.211[.]14 was followed by malicious activity inside the environment ^[15].

Both reports stop short of naming an actor, and neither links the two sets ^[17]. The two attacks work differently: one is an unauthenticated parsing bug, the other is valid credentials against a login page. The devices are placed the same way. Both sit at the perimeter and terminate traffic the organisation cannot refuse, and in both cases the first sign of trouble is in logs the compromised device may control.

Cisco said it contacted affected Secure Email Cloud customers directly, and withheld the number of devices involved ^[9].