Cisco Patches Actively Exploited Secure Email Gateway Zero-Day
Cisco has issued security updates to address a critical zero-day vulnerability affecting its Secure Email Gateway (SEG) products, which has been actively targeted in real-world attacks to achieve remote command execution with root privileges.
Radwan AbdulhadiEditor and technology writer
Vulnerability Details and Attack Vector
Cisco has addressed an actively exploited zero-day vulnerability in its Secure Email Gateway (SEG) that enables remote unauthenticated attackers to execute commands with root privileges. Tracked as CVE-2026-76519, the vulnerability originates from a relative path traversal weakness in SEG's Advanced Malware Protection (AMP) feature, triggered by improper handling of email attachments. According to details shared in a Wednesday advisory published by Cisco, threat actors can leverage this issue by sending emails containing maliciously crafted attachments through an unpatched device.
A successful exploit allows an attacker to write arbitrary files and execute commands with root privileges directly on the underlying operating system. Cisco's Product Security Incident Response Team (PSIRT) became aware of active exploitation targeting this vulnerability in October 2026. The flaw impacts SEG instances where the File Reputation service is enabled and assigned to a mail policy, and where the Content Scanner Tools version is earlier than 25.3.0.5525.
Identification and Affected Systems
System administrators looking to check whether a specific device is vulnerable must use the contentscannerstatus CLI command to identify the running version of Content Scanner Tools. Additionally, admins need to inspect the 'Enable File Reputation' checkbox under Mail Policies > Incoming Mail Policies > Advanced Malware Protection or Mail Policies > Outgoing Mail Policies > Advanced Malware Protection in the web-based management interface.
While Cisco did not disclose granular details regarding the specific attacks exploiting the CVE-2026-76519 flaw, the company published related indicators of compromise (IOCs) alongside its advisory. Internet security watchdog Shadowserver tracks nearly 300 Cisco Secure Email Gateway instances exposed online, though these figures do not distinguish between active production environments, honeypots, or already secured devices.
Mitigation and Remediation Guidance
Cisco confirmed that it has already deployed mitigations across cloud instances and directly contacted owners of Cisco Secure Email Cloud devices where potential compromise was identified. For customers whose devices may have been accessed, Cisco strongly advises restoring appliances to a secure configuration by renewing credentials and cryptographic materials installed on the device.
Furthermore, administrators should review comprehensive upgrade steps and remediation guidance found in the official Cisco documentation. Security teams are urged to cross-check network and firewall logs for any suspicious indicators—such as unusual file downloads or uploads involving external IP addresses—because attackers frequently erase evidence of exploitation after securing root-level command execution.
Context of Prior Cisco Email Security Flaws
This latest security update follows a series of notable vulnerabilities impacting Cisco's email and web infrastructure over recent years. In July 2024, Cisco addressed another critical SEG vulnerability, designated CVE-2024-20401, which permitted attackers to add root users or permanently crash appliances via malicious email attachments. Earlier, in January, the company patched a maximum-severity Cisco AsyncOS flaw (CVE-2025-20393) that had been exploited in zero-day attacks targeting SEG and Secure Email and Web Manager appliances.
Additional security warnings underscore the persistent threat landscape surrounding these products. Last month, Cisco advised customers to patch a separate actively exploited SEG zero-day involving email parsing flaws in Cisco AsyncOS Software. That vulnerability similarly allowed unauthenticated remote attackers to execute arbitrary root commands. According to BleepingComputer, these incidents form part of a broader pattern where the Cybersecurity and Infrastructure Security Agency (CISA) has added numerous vendor vulnerabilities to its known exploited catalog.
Sources
- BleepingComputerCisco patches new Secure Email Gateway zero-day exploited in attacks
Continue chronologically
Related stories
Cisco Warns of New SD-WAN Zero-Day Exploited in Attacks
Cisco has released security updates to address a critical zero-day vulnerability in Catalyst SD-WAN Manager actively exploited by attackers.
Cisco Warns of Exploited Secure Email Gateway Vulnerability
Cisco warns customers that hackers are actively exploiting a critical-severity arbitrary file write vulnerability in its Secure Email Gateway.
Cisco Warns of Zero-Day Exploit Crashing SSL VPN Devices
Cisco has released security updates to patch a denial-of-service zero-day vulnerability in its Adaptive Security Appliance and Threat Defense software.
Cisco Patches Exploited Firewall Zero-Day Flaw
Cisco has released security fixes for a remotely exploitable zero-day vulnerability in its Secure Firewall ASA and FTD software.
