Cisco patches new Secure Email Gateway zero-day exploited in attacks

CVE-2026-76519 is a critical zero-day vulnerability in Cisco Secure Email Gateway's Advanced Malware Protection feature caused by improper handling of email attachments leading to a relative path traversal weakness. Exploitation allows remote unauthenticated attackers to write arbitrary files and execute commands with root privileges on the underlying operating system. The vulnerability affects SEG instances with the File Reputation service enabled and Content Scanner Tools versions prior to 25.3.0.5525. Cisco became aware of active exploitation in October 2026 and has released patches to fix the issue. The company also provided indicators of compromise and recommended actions, including checking device versions via CLI and web interface, reviewing firewall and network logs for suspicious activity, and restoring secure configurations if compromise is suspected. Cisco has already mitigated the issue on cloud instances and reached out to customers with potential compromises.

Successful exploitation of this vulnerability allows remote unauthenticated attackers to execute arbitrary commands with root privileges on vulnerable Cisco Secure Email Gateway devices. This can lead to full system compromise, including the ability to write arbitrary files and potentially remove evidence of exploitation. The flaw is actively exploited in the wild as of October 2026, increasing the risk to affected organizations.

Cisco has released patches addressing CVE-2026-76519 in Content Scanner Tools version 25.3.0.5525 and later. Administrators should verify the version of Content Scanner Tools using the contentscannerstatus CLI command and check that the File Reputation service is enabled under mail policies. Devices running vulnerable versions should be upgraded to the fixed release. Cisco has deployed mitigations for cloud instances and contacted affected customers. For potentially compromised devices, Cisco recommends restoring secure configurations, renewing credentials and cryptographic materials, restricting appliance access, and implementing robust access controls. Customers are also advised to review firewall and network logs for suspicious activity and contact Cisco TAC for further assistance.