Cisco has patched a zero-day vulnerability in its Secure Email Gateway (SEG) that allows unauthenticated remote attackers to execute commands with root privileges on vulnerable systems. The company confirmed that the flaw was being actively exploited in attacks in October 2026.
Tracked as CVE-2026-76519, the vulnerability is caused by a relative path traversal weakness in the Advanced Malware Protection (AMP) feature, which improperly handles email attachments. Attackers can exploit the flaw by sending an email containing a specially crafted attachment through a vulnerable appliance.
“A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system,” Cisco said in a Wednesday security advisory. The company added that its Product Security Incident Response Team became aware of active exploitation in October 2026.
The vulnerability affects Cisco Secure Email Gateway deployments where the File Reputation service is enabled and assigned to a mail policy, and the Content Scanner Tools version is earlier than 25.3.0.5525.
Administrators can check their systems by running the contentscannerstatus command in the command-line interface (CLI) to identify the installed Content Scanner Tools version. They should also verify whether the “Enable File Reputation” option is selected under Mail Policies in the web-based management interface, checking both incoming and outgoing mail policies as applicable.
Cisco has provided indicators of compromise to help administrators identify potential attacks. Relevant log messages include “Suspected compromise indicator was found” and “Security scan did not complete.” If either message appears, administrators should follow Cisco’s security advisory and contact the company’s Technical Assistance Center (TAC) for further guidance. A message stating that no compromise indicator was found does not eliminate the need to install the applicable security fix.
The company also recommends reviewing firewall and network logs for suspicious activity, including unexpected data transfers to or from external or unrecognized IP addresses. Attackers who gain root-level access may attempt to remove evidence of their activity, making a thorough investigation important.
Cisco said it has deployed mitigations for cloud instances and contacted Cisco Secure Email Cloud customers when it identified evidence of a potential compromise. Customers who have been contacted should restore affected devices to a secure configuration, renew credentials and installed cryptographic materials where possible, and restrict access to the appliances using strong access controls.
The latest vulnerability adds to a series of security issues affecting Cisco’s email security products. In July 2024, Cisco addressed CVE-2024-20401, a critical flaw that could allow attackers to add users with root privileges or crash appliances using malicious email attachments.
In January 2026, Cisco also patched CVE-2025-20393, a maximum-severity AsyncOS vulnerability exploited in zero-day attacks against Secure Email Gateway and Secure Email and Web Manager appliances since November 2025.
Last month, the company warned customers about another actively exploited zero-day, CVE-2026-76461, involving email parsing in AsyncOS Software. That vulnerability also allows unauthenticated remote attackers to execute arbitrary commands with root privileges.
Security monitoring organization Shadowserver has tracked nearly 300 Cisco Secure Email Gateway instances exposed online, although the available figures do not establish how many are vulnerable, compromised, or already secured.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Cisco Patches Actively Exploited Email Gateway Zero-Day Allowing Root Access
