Cisco has released a patch for an actively exploited zero-day vulnerability in its Secure Email Gateway (SEG) product that allows remote, unauthenticated attackers to run commands with root privileges. The flaw, tracked as CVE-2026-76519, comes from a relative path traversal weakness in the SEG Advanced Malware Protection (AMP) feature that is caused by improper handling of email attachments. According to Cisco, an attacker can trigger the flaw by sending an email with a specially crafted attachment through an unpatched device. The company said a successful exploit could let an attacker write arbitrary files and execute commands with root privileges on the underlying operating system.
Cisco said its Product Security Incident Response Team became aware of active exploitation of the vulnerability in October 2026. The company did not provide additional details about the attacks but released indicators of compromise. It also advised customers to review firewall and network logs for suspicious activity, including downloads and uploads to and from external or suspicious IP addresses, because attackers may erase evidence of exploitation after obtaining root-level command execution. Specific SEG deployments are affected: those where the File Reputation service is enabled and assigned to a mail policy, and where the Content Scanner Tools version is earlier than 25.3.0.5525.
Administrators can check whether a device is vulnerable by running the contentscannerstatus CLI command to see which version of Content Scanner Tools is installed. They can also inspect the Enable File Reputation checkbox under Mail Policies in the web-based management interface, either in the Incoming Mail Policies or Outgoing Mail Policies section, under Advanced Malware Protection. Cisco said it has already deployed mitigations on cloud instances and has contacted owners of Cisco Secure Email Cloud devices where it found evidence of a possible compromise. The company strongly recommends that contacted customers restore devices to a secure configuration by renewing credentials and any cryptographic materials installed on the appliance when possible, and that they restrict access to the appliance and implement robust access control mechanisms.
The internet security watchdog Shadowserver tracks nearly 300 Cisco Secure Email Gateway instances exposed online, though it does not say how many are honeypots or have already been secured. Cisco has patched other serious SEG flaws in recent years. In July 2024 it addressed CVE-2024-20401, a critical vulnerability that lets attackers add new users with root privileges or permanently crash appliances using emails with malicious attachments. In January the company patched a maximum-severity Cisco AsyncOS flaw, CVE-2025-20393, which attackers had exploited in zero-day attacks targeting SEG and Secure Email and Web Manager appliances since November 2025.
Last month, Cisco warned customers to patch another actively exploited SEG zero-day, CVE-2026-76461, in the email parsing of Cisco AsyncOS Software that also allows unauthenticated, remote attackers to execute arbitrary commands with root privileges on the underlying operating system. Since November 2021, the Cybersecurity and Infrastructure Security Agency has added 100 Cisco vulnerabilities to its catalog of actively exploited flaws, seven of which have been abused in ransomware attacks. The affected product is used by organizations to filter email traffic, so unpatched internet-facing gateways represent a risk to US networks.
More cybersecurity news from TechManNews.
