Cybersecurity
Cisco patches Secure Email Gateway zero-day used in attacks
Cisco said it had fixed CVE-2026-76519 in Secure Email Gateway, a flaw in its Advanced Malware Protection feature that it said had been actively exploited and could let attackers run commands as root.
- Cisco said CVE-2026-76519 affected Secure Email Gateway systems with File Reputation enabled and Content Scanner Tools earlier than 25.3.0.5525.
- Cisco said an attacker could exploit the flaw by sending a malicious attachment through an unpatched device and could then write files and run commands with root privileges.
- Cisco said its PSIRT became aware of active exploitation in October 2026 and that it had deployed mitigations on cloud instances and contacted Secure Email Cloud owners where it found possible compromise.
- Shadowserver said it tracked nearly 300 Cisco Secure Email Gateway instances exposed online, but did not say how many were honeypots or already secured.
Cisco said it had fixed CVE-2026-76519, a zero-day in Secure Email Gateway that it said had been under active attack. The flaw was in the product’s Advanced Malware Protection feature and could let a remote unauthenticated attacker write files and execute commands as root.
Cisco said the issue affected systems where File Reputation was enabled and where Content Scanner Tools was earlier than 25.3.0.5525. It said attackers could trigger the flaw by sending a malicious attachment through an unpatched device.
The company said its PSIRT learned of active exploitation in October 2026. It said it had already put mitigations in place on cloud instances and had contacted Cisco Secure Email Cloud owners where it saw signs of possible compromise.
Cisco told customers who had been contacted to renew credentials and any cryptographic materials on the appliance where possible, and to restrict access and use strong access controls. It also told administrators to check firewall and network logs for suspicious downloads and uploads, saying attackers might remove evidence after gaining access.
Named in this story
Companies
- Cisco
- patched the flaw and issued the advisory
Organisations
- Cisco PSIRT
- became aware of active exploitation in October 2026
- Shadowserver
- tracked nearly 300 exposed Cisco Secure Email Gateway instances online
Governments and agencies
- Cybersecurity and Infrastructure Security Agency
- kept a catalogue of Cisco vulnerabilities actively exploited since November 2021
Products and systems
- Cisco Secure Email Gateway
- the affected email security appliance
- Advanced Malware Protection
- the feature where the path traversal weakness arose
- File Reputation service
- had to be enabled for the flaw to affect an instance
- Content Scanner Tools
- had to be earlier than version 25.3.0.5525 on vulnerable devices
- Cisco Secure Email Cloud
- had mitigations deployed on cloud instances and owners contacted where compromise was suspected
- Cisco AsyncOS Software
- was named in Cisco’s earlier warning about a separate zero-day flaw
- Secure Email and Web Manager
- was named in Cisco’s earlier warning about a separate zero-day flaw
How the source tells it
The piece was technical and cautionary, with most of its pressure coming from Cisco’s active-exploitation warning and the follow-on remediation advice.
- urgency active exploitation and immediate remediation guidance framed the issue as time-sensitive
- threat emphasis root-level command execution and evidence removal were presented as the likely consequences of compromise