Cisco Secure Email Gateway zero-day exploited in the wild, CISA orders federal patch by Saturday

A critical vulnerability in Cisco's Secure Email Gateway allows unauthenticated attackers to gain root access by sending a malicious email. CISA has added CVE-2026-76519 to its Known Exploited Vulnerabilities catalog and given federal agencies until Saturday to patch.

Cisco disclosed a critical zero-day vulnerability in its Secure Email Gateway (SEG) on Wednesday that attackers have already exploited to gain root access on appliances. The flaw, tracked as CVE-2026-76519, carries a CVSS score of 9.8 out of 10 and allows remote, unauthenticated command execution through a malicious email attachment.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities catalog the same day and ordered federal civilian agencies to apply fixes by Saturday, October 17.

"We are aware of active exploitation of this vulnerability," a Cisco spokesperson said. The company declined to say how many appliances have been compromised or what attackers did after gaining access.

The bug lives in SEG's Advanced Malware Protection (AMP) feature, specifically in how the File Reputation service handles email attachments. An attacker sends an email with a crafted attachment. If the appliance processes it, the attacker can write files and execute commands as root on the underlying operating system.

The vulnerability affects both physical and virtual SEG appliances running vulnerable releases of Cisco AsyncOS Software when two conditions are met: the File Reputation service is enabled and assigned to a mail policy, and the Content Scanner Tools version is earlier than 25.3.0.5525.

Cisco has released fixed AsyncOS Software versions. The vendor recommends customers on releases earlier than 16.5 migrate to 16.5.0-780. No workarounds exist.

This marks the second actively exploited zero-day in Cisco SEG in two months. In mid-September, Cisco warned of CVE-2026-76461, a similar root-access bug also triggered by malicious email. In January, attackers exploited CVE-2025-20393 to breach SEG appliances and install persistence mechanisms. That vulnerability eventually received a perfect CVSS score of 10.

Organizations running Cisco SEG should check their Content Scanner Tools version and File Reputation configuration immediately using the steps in Cisco's advisory, then apply the appropriate software update.

Source : theregister.com