Exploited Cisco email gateway flaw lets a crafted attachment run commands as root
Cisco patched CVE-2026-76519, an exploited Secure Email Gateway flaw that gives unauthenticated attackers root through a crafted email attachment. Devices with File Reputation enabled and Content Scanner Tools earlier than 25.3.0.5525 are affected.
The Watch · Security desk
Gateways are affected with File Reputation on a mail policy and Content Scanner Tools before 25.3.0.5525. Shadowserver tracks nearly 300 online. Admins can check both settings. Cisco urges log checks, contacted some cloud owners and advises renewing credentials.
- exposure SEG with File Reputation on Affected if File Reputation is on a mail policy and Content Scanner Tools is before 25.3.0.5525, claim 5
- exposure Gateways exposed online Shadowserver tracks nearly 300, not saying how many are honeypots or secured, claim 11
- capability SEG admins Check the version with contentscannerstatus and the Enable File Reputation checkbox, claim 6
- constraint Customers Cross-check firewall and network logs, as attackers may remove evidence after gaining root, claim 8
- decision Secure Email Cloud owners Contacted by Cisco where it found evidence of a potential compromise, claim 9
- cost Contacted customers Cisco recommends renewing credentials and cryptographic materials on the appliance, claim 10
| Who | How | Kind | Claim |
|---|---|---|---|
| SEG with File Reputation on | Affected if File Reputation is on a mail policy and Content Scanner Tools is before 25.3.0.5525 | exposure | 5 |
| Gateways exposed online | Shadowserver tracks nearly 300, not saying how many are honeypots or secured | exposure | 11 |
| SEG admins | Check the version with contentscannerstatus and the Enable File Reputation checkbox | capability | 6 |
| Customers | Cross-check firewall and network logs, as attackers may remove evidence after gaining root | constraint | 8 |
| Secure Email Cloud owners | Contacted by Cisco where it found evidence of a potential compromise | decision | 9 |
| Contacted customers | Cisco recommends renewing credentials and cryptographic materials on the appliance | cost | 10 |
What happened
- The flaw is a relative path traversal in the Advanced Malware Protection feature, caused by improper handling of email attachments sent through an unpatched device.
- Cisco's PSIRT became aware of active exploitation in October 2026, according to the advisory Cisco published on a Wednesday.
- Cisco published indicators of compromise for the attacks but, per BleepingComputer, shared no further details about them.
- Cisco says it has deployed mitigations on cloud instances and contacted Secure Email Cloud owners where it found evidence of a potential compromise.
Why it matters
- exposure Shadowserver counts nearly 300 gateways exposed online, but the figure does not separate honeypots or secured devices, so it is not a count of vulnerable ones.
- decision A patched device still needs a log review, because Cisco warns that attackers may remove evidence of exploitation after gaining root.
- precedent At least two of the three exploited zero-days since November 2025 reach root through email handling, so we'd expect further advisories of this kind for the product.
Exploitability is high on any device that meets Cisco's two conditions. The attacker needs no account [1], and the trigger is a message sent through the device [2]. Cisco's advisory states the outcome: "A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system." [3]
The conditions are File Reputation enabled and assigned to a mail policy, and Content Scanner Tools earlier than 25.3.0.5525 [5]. Admins read the version with the contentscannerstatus CLI command. They then check the "Enable File Reputation" checkbox under Mail Policies > Incoming Mail Policies > Advanced Malware Protection, or under Mail Policies > Outgoing Mail Policies > Advanced Malware Protection [6]. The affected range ends below 25.3.0.5525, so a device on that build or a later one is outside it [14].
Cisco's hunting guidance is to cross-check firewall and network logs for suspicious activity, including downloads and uploads to and from external or suspicious IP addresses [8]. For customers it contacted, the advice is to restore the device. Cisco said: "Cisco strongly recommends that customers who have been contacted restore a device to a secure configuration by renewing credentials and any cryptographic materials that are installed on the appliance, when possible." [10]
The product line has a history. In January Cisco patched CVE-2025-20393, a maximum-severity AsyncOS flaw that attackers have exploited in zero-day attacks on Secure Email Gateway and Secure Email and Web Manager appliances since November 2025 [12]. Last month, BleepingComputer reports, Cisco warned of CVE-2026-76461, an email-parsing flaw in AsyncOS that also lets unauthenticated remote attackers run commands as root [13]. CVE-2026-76519 is the third exploited zero-day in the line since November 2025 [15]. The report does not tie the three to one actor, so a single campaign is not established.
What to watch
- Whether Cisco discloses who is exploiting CVE-2026-76519 and when exploitation began.
- Whether CISA adds CVE-2026-76519 to its catalog of actively exploited vulnerabilities.
- Whether Shadowserver's count of exposed Secure Email Gateway instances falls after the patch.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap0
- Incentives
- Insufficient
- Confidence62
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Cisco patched CVE-2026-76519, an actively exploited zero-day in its Secure Email Gateway that lets remote unauthenticated attackers execute commands with root privileges.
- [2]
CVE-2026-76519 stems from a relative path traversal weakness in SEG's Advanced Malware Protection feature, caused by improper handling of email attachments; attackers exploit it by sending an email with a maliciously crafted attachment through an unpatched device.
- [3]
Cisco said in a Wednesday advisory: "A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system."
- [4]
Cisco said in the Wednesday advisory that in October 2026 the Cisco PSIRT became aware of active exploitation of this vulnerability.
- [5]
CVE-2026-76519 affects SEG instances where the File Reputation service is enabled and assigned to a mail policy, and the Content Scanner Tools version is earlier than 25.3.0.5525.
- [6]
Admins check the Content Scanner Tools version with the contentscannerstatus CLI command and inspect the "Enable File Reputation" checkbox under Mail Policies > Incoming Mail Policies > Advanced Malware Protection or Mail Policies > Outgoing Mail Policies > Advanced Malware Protection in the web-based management interface.
- [7]
Cisco did not share further details about attacks exploiting CVE-2026-76519 but shared indicators of compromise.
- [8]
Cisco warned customers to cross-check firewall and network logs for signs of suspicious activity, including downloads and uploads to and from external or suspicious IP addresses, because attackers may remove evidence of exploitation after gaining root-level command execution.
- [9]
Cisco has already deployed mitigations on cloud instances and contacted Cisco Secure Email Cloud device owners where it found evidence of a potential compromise.
- [10]
Cisco said: "Cisco strongly recommends that customers who have been contacted restore a device to a secure configuration by renewing credentials and any cryptographic materials that are installed on the appliance, when possible."
- [11]
Shadowserver tracks nearly 300 Cisco Secure Email Gateway instances exposed online, but provides no information on how many are honeypots or have already been secured.
- [12]
In January, Cisco patched a maximum-severity AsyncOS flaw, CVE-2025-20393, that attackers have exploited in zero-day attacks targeting SEG and Secure Email and Web Manager appliances since November 2025.
- [13]
Last month, Cisco warned customers to patch CVE-2026-76461, an actively exploited SEG zero-day in the email parsing of Cisco AsyncOS Software that lets unauthenticated, remote attackers execute arbitrary commands with root privileges on the underlying OS.
- [14]
A device running Content Scanner Tools 25.3.0.5525 or later is outside the stated affected range.
- [15]
CVE-2026-76519 is the third actively exploited zero-day in the Secure Email Gateway/AsyncOS line since November 2025.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- bleepingcomputer.comCisco patches new Secure Email Gateway zero-day exploited in attacks
1 article · October 14, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Entities
- CiscoFollow
- Cisco Secure Email GatewayFollow
- CVE-2026-76519Follow
- CVE-2026-76461Follow
- CVE-2025-20393Follow
- Shadowserver FoundationFollow