GoKawiilCisco fixes actively exploited root-privilege zero-day in Secure Email Gateway
Cisco has released a patch for CVE-2026-76519, a path traversal bug in Secure Email Gateway's Advanced Malware Protection feature that lets unauthenticated attackers send a malicious email attachment to gain root-level command execution on unpatched devices. Cisco's security team said it detected active exploitation of the flaw in October 2026 and published indicators of compromise for administrators to check their systems. The vulnerability only affects devices with File Reputation enabled and running Content Scanner Tools versions earlier than 25.3.0.5525.
GoKawiil's interpretation of the reporting above, not reported fact.
A root-level, unauthenticated flaw in an email security gateway is especially dangerous because the very system meant to screen malicious attachments becomes the attack vector, potentially giving attackers a foothold deep inside corporate networks. This marks another in a string of SEG zero-days Cisco has had to address, which could prompt enterprises to reassess patch cadence and monitoring for this product line. Organizations that delay applying the fix remain exposed to exploitation already observed in the wild, according to Cisco's advisory.
- CVE-2026-76519 allows root-level command execution via a crafted email attachment on unpatched Secure Email Gateway devices.
- Cisco confirmed active exploitation was detected in October 2026 and released indicators of compromise for admins to check.
- Only devices with File Reputation enabled and Content Scanner Tools versions earlier than 25.3.0.5525 are affected.
Source: bleepingcomputer.com, 2026-10-14
Published there as: “Cisco patches new Secure Email Gateway zero-day exploited in attacks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.