Cisco strongly advises its customers to patch a critical vulnerability in the Secure Email Gateway (SEG). The vulnerability allows unauthenticated attackers to gain root-level access. The security flaw is currently being exploited in zero-day attacks.
This is the third actively exploited security issue to affect Cisco’s email gateway products this year. The vulnerability is registered as CVE-2026-76519. It has a CVSS score of 9.8. The vulnerability is located in the Advanced Malware Protection (AMP) functionality and results from improper handling of email attachments.
Attackers can exploit the vulnerability by sending a malicious email attachment to a vulnerable gateway. If the attack succeeds, attackers can write arbitrary files and execute commands with root privileges without authentication.
According to The Register, Cisco confirmed that the vulnerability affects a limited number of customers. The company was notified of active exploitation in October but did not disclose how many systems were compromised. The company also did not disclose what attackers did after gaining access.
CISA calls for prompt security update
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-76519 to its catalog of known exploited vulnerabilities. Federal agencies have until October 17 to patch the vulnerability.
The vulnerability can affect both physical and virtual Secure Email Gateway devices running vulnerable versions of AsyncOS. Two conditions must be met. First, File Reputation must be enabled and assigned to an email policy. Second, Content Scanner Tools must be running a version older than 25.3.0.5525.
The manufacturer recommends that customers upgrade to a patched software version. Customers using AsyncOS versions older than 16.5 must migrate to version 16.5.0-780. Workarounds are not available.
In September, Cisco disclosed CVE-2026-76461. This was another actively exploited vulnerability that allowed attackers to gain root privileges via a malicious email. In January of this year, attackers exploited CVE-2025-20393, a critical AsyncOS vulnerability with a maximum CVSS score of 10. This vulnerability allowed attackers to compromise Secure Email Gateway devices and gain persistent access.