Cisco patches an actively exploited Secure Email Gateway zero-day

Cisco has patched another actively exploited zero-day in its Secure Email Gateway (SEG), tracked as CVE-2026-76519, that lets remote, unauthenticated attackers execute commands with root privileges, according to the company's advisory. Cisco says it became aware of active exploitation in October 2026. The flaw is in the appliance's Advanced Malware Protection feature and is triggered through a crafted email attachment.

What's happening

According to BleepingComputer, CVE-2026-76519 stems from a relative path traversal weakness in SEG's Advanced Malware Protection (AMP) feature, caused by improper handling of email attachments. Threat actors can reportedly exploit it by sending an email with a maliciously crafted attachment through an unpatched device. Cisco's advisory states that "a successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system," and that "in October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability."

Cisco says the flaw affects SEG instances where the File Reputation service is enabled and assigned to a mail policy, and where the Content Scanner Tools version is earlier than 25.3.0.5525. To check whether a device is vulnerable, administrators can use the contentscannerstatus CLI command to see which version of Content Scanner Tools is running, and inspect the "Enable File Reputation" checkbox under Mail Policies in the management interface. Cisco has not shared details of the attacks beyond a set of indicators of compromise.

The advisory lists log messages administrators can look for, including "System Security: Suspected compromise indicator was found," "Security scan did not complete," and "No compromise indicator was found," each paired with a recommended action. Cisco also warns customers to cross-check firewall and network logs for suspicious activity, such as downloads and uploads to and from external or suspicious IP addresses, because attackers may remove evidence after gaining root-level command execution.

Who's affected

The vulnerability affects organisations running Cisco Secure Email Gateway on-premises with File Reputation enabled and an outdated Content Scanner Tools version. Cisco says it has already deployed mitigations on cloud instances and contacted Cisco Secure Email Cloud device owners where it found evidence of a potential compromise, so cloud customers may already be covered. Internet security watchdog Shadowserver reportedly tracks nearly 300 Cisco Secure Email Gateway instances exposed online, though it does not say how many are honeypots or have already been secured.

This is part of a pattern. BleepingComputer notes that Cisco addressed another critical SEG flaw (CVE-2024-20401) in July 2024, a maximum-severity Cisco AsyncOS flaw (CVE-2025-20393) in January that attackers had exploited since November 2025, and another exploited SEG zero-day (CVE-2026-76461) last month. Since November 2021, CISA has added 100 Cisco vulnerabilities to its catalog of actively exploited flaws, seven of which have been abused in ransomware attacks.

What to do

Apply Cisco's fixed software release as soon as possible, and confirm your Content Scanner Tools version is 25.3.0.5525 or later.
Check the advisory's log messages. If you see "Suspected compromise indicator was found," follow the Recommendations section and contact Cisco's Technical Assistance Center (TAC).
Cross-check firewall and network logs for suspicious downloads or uploads to external or suspicious IP addresses, since evidence of exploitation may have been erased.
If you have been contacted by Cisco or suspect compromise, restore the device to a secure configuration by renewing credentials and any cryptographic materials installed on the appliance, restrict access, and apply strong access controls.
Review the full Cisco advisory for the current IOCs and any updates, as this is an evolving situation.

Sources

Cisco Security Advisory — the vendor advisory for CVE-2026-76519, its affected versions, indicators of compromise, and remediation guidance.
BleepingComputer — reports the flaw, the affected conditions, the exposure count, and the recent history of SEG zero-days.
The Hacker News — reports that Cisco warned of active attacks exploiting the Secure Email Gateway flaw.