Cisco Warns of Exploited Secure Email Gateway Vulnerability
Cisco has issued warnings regarding an actively exploited zero-day vulnerability affecting its Secure Email Gateway appliance, allowing remote unauthenticated attackers to write arbitrary files and execute commands with root privileges.
Radwan AbdulhadiEditor and technology writer
Critical Vulnerability Details
Cisco has warned customers that hackers have been actively exploiting a critical-severity security defect affecting its Secure Email Gateway. Tracked under the identifier CVE-2026-76519 with a CVSS score of 9.8 out of 10, the vulnerability impacts the Advanced Malware Protection (AMP) feature of the appliance, as reported by <a href="https://www.securityweek.com/cisco-warns-of-exploited-secure-email-gateway-vulnerability/">SecurityWeek</a>.
According to technical advisories, the security issue stems from improper handling of email attachments. Specifically, the flaw exists when the file reputation service is enabled and when a Content Scanner Tools version earlier than 25.3.0.5525 is installed on the targeted appliance. Unauthenticated, remote attackers can exploit this vulnerability by sending emails containing maliciously crafted attachments.
Attack Mechanics and Root Privileges
When successfully triggered, the vulnerability allows malicious actors to write arbitrary files to the operating system and execute arbitrary commands with root privileges. <a href="https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp">warns</a> that the Cisco Product Security Incident Response Team (PSIRT) became aware of active exploitation of the defect in October 2026.
This security issue marks the second Cisco Secure Email Gateway vulnerability to be exploited in the wild since mid-September. It follows <a href="https://www.securityweek.com/root-rce-zero-day-in-cisco-secure-email-gateway-under-active-exploitation/">CVE-2026-76461</a>, another unauthenticated bug that previously allowed remote command execution with root privileges on the underlying operating system.
Mitigation and Remediation Guidance
Cisco has published indicators of compromise (IoCs) to assist organizations in hunting for potential intrusions on their systems. However, the company cautioned that threat actors might abuse their elevated root access to remove or hide evidence of exploitation, advising administrators to check external network and firewall logs for unexpected data uploads or downloads.
For physical appliances suspected of compromise, Cisco advises contacting its Technical Assistance Center (TAC). For virtual appliances, the vendor recommends deploying a new virtual machine running a fixed software release, rebuilding the configuration from scratch, and rotating credentials while retaining forensic evidence.
Software Fixes and Updates
Cisco states that it has directly contacted customers owning Cisco Secure Email Cloud devices where indicators of potential compromise were identified, and noted that mitigations within Cisco's management have already been deployed.
Organizations are urged to migrate to a patched AsyncOS software release as soon as possible. Fixes for CVE-2026-76519 were initially rolled out on September 14 in Secure Email Gateway versions 15.5.5-014 and 16.5.0-780, initially grouped under CVE-2026-76440 before the advisory was updated to highlight active in-the-wild exploitation.
Sources
- SecurityWeekCisco Warns of Exploited Secure Email Gateway Vulnerability
- BleepingComputerCisco patches new Secure Email Gateway zero-day exploited in attacks
- BleepingComputerGitLab warns of max severity code execution vulnerability
Continue chronologically
Related stories
Cisco Patches Actively Exploited Secure Email Gateway Zero-Day
Cisco has released a security patch for a newly disclosed Secure Email Gateway zero-day vulnerability actively exploited in remote root command attacks.
Cisco Warns of New SD-WAN Zero-Day Exploited in Attacks
Cisco has released security updates to address a critical zero-day vulnerability in Catalyst SD-WAN Manager actively exploited by attackers.
Cisco Patches Exploited Firewall Zero-Day Flaw
Cisco has released security fixes for a remotely exploitable zero-day vulnerability in its Secure Firewall ASA and FTD software.
Cisco Patches Actively Exploited SD-WAN Zero-Day Flaw
Cisco has released urgent patches for a critical zero-day authentication bypass vulnerability in Catalyst SD-WAN Manager actively exploited in the wild.
