Cisco has issued patches for a critical zero-day vulnerability in its Secure Email Gateway (SEG) product that attackers are already exploiting in active campaigns. The flaw, tracked as CVE-2026-76519, allows unauthenticated remote attackers to write arbitrary files to the underlying operating system and execute commands with root privileges.
How the Attack Works
The vulnerability stems from a relative path traversal weakness in SEG’s Advanced Malware Protection (AMP) feature, caused by improper handling of email attachments. An attacker simply sends an email containing a maliciously crafted attachment through an unpatched gateway. If the exploit succeeds, the attacker gains the ability to write files to the appliance and run commands as root, no prior authentication required.
Cisco said its Product Security Incident Response Team became aware of active exploitation of this vulnerability in October 2026, though the company has not disclosed further details about the attacks or the threat actors involved.
Who Is Affected
CVE-2026-76519 affects SEG instances where the File Reputation service is enabled and assigned to a mail policy, and where the Content Scanner Tools version is earlier than 25.3.0.5525. Administrators can check exposure using the contentscannerstatus CLI command and by reviewing the “Enable File Reputation” checkbox under Mail Policies in the web management interface, for both incoming and outgoing mail policies.
Detection and Response
Cisco published indicators of compromise tied to internal system security log messages, ranging from confirmed compromise indicators to scans that failed to complete. The company is urging customers to cross-reference firewall and network logs for suspicious uploads or downloads to external IP addresses, warning that attackers may erase evidence of exploitation after achieving root-level access.
Cisco said it has already deployed mitigations on its cloud instances and has directly contacted Cisco Secure Email Cloud customers where potential compromise was detected. Affected customers are strongly advised to restore devices to a secure configuration, renew all credentials and cryptographic materials on the appliance, and restrict access with robust access control mechanisms.
Security teams running Cisco Secure Email Gateway should prioritize patching immediately given confirmed active exploitation and the root-level impact of successful attacks.