Cisco Secure Email Gateway zero-day CVE-2026-76519 patched

Cisco has released fixes for a Secure Email Gateway (SEG) vulnerability that attackers are already exploiting. The flaw allows remote attackers to run commands with root privileges without any authentication.

The bug is tracked as CVE-2026-76519. It is the latest in a series of exploited flaws affecting the company's email security appliances.

A malicious attachment is enough

The vulnerability is a relative path traversal weakness in the Advanced Malware Protection (AMP) feature of SEG. It comes from the way the appliance handles email attachments. To exploit it, an attacker only needs to send an email with a specially crafted attachment through an unpatched device. The attacker does not need to log in or interact with the appliance in any other way.

"A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system," Cisco said in its advisory, published on Wednesday.

The company also confirmed that the flaw has been used in real attacks. "In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability," the advisory states. PSIRT is Cisco's Product Security Incident Response Team, which handles vulnerability reports and security advisories.

Cisco did not share any details about the attacks, such as who is behind them or which organizations were targeted. It did publish a set of indicators of compromise (IOCs) that defenders can use to look for signs of intrusion.

Which devices are affected

Not every SEG appliance is exposed. A device is vulnerable only if two conditions are met:

• the File Reputation service is enabled and assigned to a mail policy
• the Content Scanner Tools version is earlier than 25.3.0.5525

Administrators can check the installed Content Scanner Tools version with the contentscannerstatus CLI command. To see whether File Reputation is turned on, they need to look at the "Enable File Reputation" checkbox in the web-based management interface. It can be found under Mail Policies > Incoming Mail Policies > Advanced Malware Protection, or under Mail Policies > Outgoing Mail Policies > Advanced Malware Protection.

Attackers may cover their tracks

Cisco warned that the absence of obvious evidence on an appliance does not prove that it is clean. After gaining root-level command execution, attackers may delete traces of the exploitation.

For that reason, the company advises customers to review firewall and network logs as well. Admins should look for suspicious activity, including downloads and uploads to and from external or suspicious IP addresses.

Cisco said it has already deployed mitigations on cloud instances. It has also contacted owners of Cisco Secure Email Cloud devices where it found evidence of a potential compromise.

"Cisco strongly recommends that customers who have been contacted restore a device to a secure configuration by renewing credentials and any cryptographic materials that are installed on the appliance, when possible. In addition, Cisco strongly recommends restricting access to the appliance and implementing robust access control mechanisms," the company said.

According to Shadowserver, an internet security watchdog that scans for exposed systems, nearly 300 Cisco Secure Email Gateway instances can be reached online. The organization does not say how many of them are honeypots or have already been secured.

Not the first SEG zero-day

This is far from the first serious problem with Cisco's email security products.

In July 2024, Cisco fixed a critical SEG flaw, CVE-2024-20401. Attackers could use it to add new users with root privileges or to crash appliances permanently, also by sending emails with malicious attachments.

In January, the company patched CVE-2025-20393, a maximum-severity Cisco AsyncOS flaw. Attackers had been exploiting it in zero-day attacks against SEG and Secure Email and Web Manager (SEWM) appliances since November 2025.

Last month, Cisco urged customers to patch yet another exploited SEG zero-day, CVE-2026-76461. That bug sits in the email parsing of Cisco AsyncOS Software. Like the new flaw, it lets unauthenticated, remote attackers execute arbitrary commands with root privileges on the underlying operating system.

The broader record is also long. Since November 2021, the US Cybersecurity and Infrastructure Security Agency (CISA) has added 100 Cisco vulnerabilities to its catalog of actively exploited flaws. Seven of them have been abused in ransomware attacks.

Cisco has had a busy few weeks. Earlier this month the company also fixed flaws in NX-OS that could let attackers take over Nexus switches.

Our Take

The most worrying detail is how little an attacker has to do. Email gateways exist to receive mail from anyone on the internet, so the attack surface cannot simply be closed. Blocking a single crafted attachment is enough for the attacker, and the bug sits inside a malware protection feature that is meant to make the device safer. This suggests that organizations that enabled File Reputation to strengthen their defenses may have widened their exposure without knowing it.

The pattern also matters. This is the second exploited SEG zero-day within roughly a month, and the third serious one this year when the January AsyncOS fix is included. Attackers clearly see these appliances as worthwhile targets. That fits a wider trend of threat actors focusing on edge and perimeter devices. Recent examples include the Ivanti Connect Secure zero-day chain and the exploited SonicWall SMA1000 flaw. These systems are often trusted, poorly monitored and hard to inspect from the inside.

Cisco's warning that attackers may erase evidence should be taken seriously. Applying the update does not undo a compromise that has already happened. Teams running affected appliances should treat log reviews and credential rotation as part of the patching job, not as optional extras.

It is worth watching whether CISA adds CVE-2026-76519 to its exploited vulnerabilities catalog. Researchers or Cisco may also share more about who is behind the attacks. Given that seven earlier Cisco flaws ended up in ransomware campaigns, defenders should not assume this one will stay limited to targeted intrusions.