Cisco Patches Actively Exploited Secure Email Gateway Zero-Day Allowing Root Command Execution
Cisco has patched another actively exploited zero-day vulnerability in its Secure Email Gateway (SEG) that allows remote, unauthenticated attackers to execute commands with root privileges.
Tracked as CVE-2026-76519, the vulnerability is a relative path traversal flaw in SEG’s Advanced Malware Protection (AMP) feature. It is caused by improper handling of email attachments and can be exploited by sending a maliciously crafted attachment through an unpatched appliance.
“A successful exploit could allow the attacker to write arbitrary files or execute commands with root privileges on the underlying operating system,” Cisco said in its Wednesday security advisory. “In October 2026, Cisco PSIRT became aware of active exploitation of this vulnerability.”
Which Cisco Secure Email Gateway devices are vulnerable?
CVE-2026-76519 affects SEG instances that meet all of the following conditions:
- The File Reputation Service is enabled.
- The service is assigned to a mail policy.
- The Content Scanner Tool version is earlier than 25.3.0.5525.
Administrators can check the installed Content Scanner Tool version by running the contentscannerstatus CLI command. They should also verify whether File Reputation is enabled under Mail Policies > Incoming Mail Policies > Advanced Malware Protection or Mail Policies > Outgoing Mail Policies > Advanced Malware Protection.
Cisco shares indicators of compromise
Cisco did not provide details about the attacks exploiting CVE-2026-76519 but shared indicators of compromise (IOCs) and recommended actions in its security advisory.
| Log message | Recommended action |
|---|---|
| System Security: Suspected Compromise Indicators Found. Please contact TAC for further recommendations. | A breach has been detected. Follow the instructions in the Recommendations section of Cisco’s security advisory. |
| System Security: Security scan did not complete. Please contact TAC for further recommendations. | Contact the Cisco Technical Assistance Center (TAC) for further assistance. |
| System Security: No indicators of compromise found. | No compromise was detected. If applicable, upgrade to a fixed software release. |
Organizations urged to review network logs
Cisco also warned customers to cross-check firewall and network logs for suspicious activity, including downloads and uploads to or from external or suspicious IP addresses. An attacker could delete evidence of exploitation after executing commands with root privileges on a vulnerable system.
The company said it has already implemented mitigations on cloud instances and contacted owners of Cisco Secure Email Cloud devices to look for evidence of potential compromise.
“Cisco strongly recommends that contacted customers restore their devices to a secure configuration by updating the credentials and cryptographic materials installed on their appliances, if possible. Additionally, we strongly recommend that customers restrict access to their appliances and implement robust access control mechanisms,” the company said.
Internet security watchdog Shadowserver tracks approximately 300 Cisco Secure Email Gateway instances online. However, it does not provide information about how many of those systems are honeypots or whether they have already been secured.
Cisco Secure Email Gateway has faced multiple exploited flaws
Cisco addressed another critical SEG vulnerability, CVE-2024-20401, in July 2024. The flaw allows an attacker to add a new user with root privileges or permanently crash the appliance by sending an email containing a malicious attachment.
In January, Cisco patched a maximum-severity flaw in Cisco AsyncOS, CVE-2025-20393, which attackers had been exploiting in zero-day attacks targeting SEG and Secure Email and Web Manager (SEWM) appliances since November 2025.
More recently, Cisco warned customers to patch another actively exploited SEG zero-day, CVE-2026-76461. The vulnerability affects email parsing in Cisco AsyncOS software and allows unauthenticated remote attackers to execute arbitrary commands with root privileges on the underlying operating system.
Since November 2021, the Cybersecurity and Infrastructure Security Agency (CISA) has added 100 Cisco vulnerabilities to its Known Exploited Vulnerabilities catalog. Seven of those vulnerabilities have been exploited in ransomware attacks.
Join Mikko Hypponen and security leaders from the NFL, Chanel, and Atlassian for a 2-hour digital summit about what will change with AI speed attacks, what defenders should stop doing, and how to verify, decide, correct, and revalidate at machine speed.
Source: www.bleepingcomputer.com