Cisco Patches New Actively Exploited Secure Email Gateway Zero-Day

Cisco has released a fix for yet another zero-day vulnerability in its Secure Email Gateway (SEG). Tracked as CVE-2026-76519, the flaw allowed a remote, unauthenticated attacker to execute arbitrary commands with root privileges on the device's underlying operating system.

How the attack works

The weakness lies in the Advanced Malware Protection (AMP) feature and stems from improper handling of email attachments — a relative path traversal bug. To exploit it, an attacker only needs to send an email with a maliciously crafted attachment through an unpatched device. A successful exploit lets them write arbitrary files and run commands as root.

According to Cisco, its PSIRT team became aware of active exploitation of the vulnerability in the wild in October 2026.

Who is at risk

Affected are SEG instances where the File Reputation service is enabled and assigned to a mail policy, and where the Content Scanner Tools version is earlier than 25.3.0.5525. Admins can check the version with the contentscannerstatus CLI command and verify the service via the "Enable File Reputation" checkbox in the incoming and outgoing mail policy settings of the web interface.

Cisco did not share details of the attacks but published indicators of compromise. It also warned that attackers with root access may erase traces of their intrusion, so administrators should cross-check firewall and network logs for suspicious activity, including traffic to and from external IP addresses.

For cloud instances, Cisco has already deployed mitigations and contacted owners of Cisco Secure Email Cloud devices where it found signs of potential compromise. Affected customers are advised to restore a secure configuration by renewing credentials and all cryptographic materials on the appliance, and to tighten access controls.

Not the first time

The Shadowserver monitoring service counts nearly 300 Cisco SEG instances exposed online, though it is unclear how many are honeypots or already secured.

This is far from the first serious SEG flaw. In July 2024 Cisco patched the critical CVE-2024-20401, which allowed adding root-level users. In January it fixed the maximum-severity CVE-2025-20393, exploited since November 2025. And just a month earlier, the company warned of another actively exploited zero-day, CVE-2026-76461, in the AsyncOS email parsing.

Since November 2021, the U.S. agency CISA has added 100 Cisco vulnerabilities to its catalog of actively exploited flaws, seven of which have been abused in ransomware attacks.

Source: Bleeping Computer