Cisco Warns of Critical Vulnerability in Secure Email Gateway

Cisco has strongly urged customers to install a patch for another critical vulnerability in the Secure Email Gateway (SEG), which has already been exploited in zero-day attacks. A Cisco representative informed The Register about this. The vulnerability has been rated 9.8 out of 10 on the CVSS scale and is tracked as CVE-2026-76519. It allows remote unauthenticated attackers to write files and execute commands with root privileges on the device's OS by simply sending a malicious email. A limited number of customers are affected.

On Wednesday, Cisco and the US government issued separate advisories warning that attacks had begun before the patch was released. The US Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its catalog of known exploited vulnerabilities and set a deadline for federal agencies to address it by Saturday. A Cisco representative confirmed active exploitation but declined to answer questions about the number of compromised devices and the actions of the attackers. "We strongly urge customers to update and follow the recommendations to strengthen protection," he stated.

The issue lies in the Advanced Malware Protection (AMP) feature and is related to improper handling of attachments. Physical and virtual SEGs on vulnerable versions of Cisco AsyncOS are affected under two conditions: the File Reputation service is enabled and assigned to a mail policy, and the Content Scanner Tools version is below 25.3.0.5525. The fix is an AsyncOS update, with no workarounds available. Customers on versions below 16.5 are advised to upgrade to 16.5.0-780. Cisco learned of the active exploitation in October.

This is the second such zero-day vulnerability in SEG in two months. In mid-September, CVE-2026-76461 was exploited with a similar mechanism—a malicious email provided root access. In January, attackers used CVE-2025-20393 to penetrate SEG and establish persistence mechanisms; this vulnerability received the maximum score of 10.