Skip to content
Cisco Patches Actively Exploited Zero-Day in Secure Email Gateway

Cisco Patches Actively Exploited Zero-Day in Secure Email Gateway

First seen 14 Oct 2026, 18:36 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 14, 2026 at 19:36 UTC
  • •CVE-2026-76519 is a critical zero-day vulnerability in Cisco's Secure Email Gateway.
  • •Attackers can exploit this flaw to execute commands with root privileges via malicious email attachments.
  • •Cisco has confirmed active exploitation and recommends immediate patching and security measures.

Cisco has released a patch for CVE-2026-76519, a critical zero-day vulnerability in its Secure Email Gateway (SEG) that allows unauthenticated remote attackers to execute commands with root privileges. This flaw, stemming from improper handling of email attachments in the Advanced Malware Protection (AMP) feature, affects SEG instances with the File Reputation service enabled and Content Scanner Tools versions earlier than 25.3.0.5525. Cisco confirmed active exploitation of this vulnerability in October 2026. Administrators are advised to check their SEG configurations and implement recommended security measures. Cisco has already deployed mitigations on cloud instances and contacted affected device owners. The company also provided indicators of compromise (IOCs) for further investigation.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2024-07-17
CVE-2024-20401 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2025-12-17
CVE-2025-20393 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-14
CVE-2026-76461 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-14
CVE-2026-76519 published
Cisco disclosed a zero-day vulnerability in Secure Email Gateway allowing remote command execution.
BleepingComputer
2026-10-14
Patch released
Cisco released software updates to address CVE-2026-76519, urging affected users to apply them immediately.
sec.cloudapps.cisco.com

More articles in this cluster (2)

Following this threat?

Track CVE-2024-20401 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (9)

1 / 4

Common questions

Which SEG versions are affected?
SEG instances with the File Reputation service enabled and Content Scanner Tools versions earlier than 25.3.0.5525 are affected.
Is there confirmed exploitation of this vulnerability?
Yes, Cisco confirmed active exploitation of CVE-2026-76519 in October 2026.
What should administrators do immediately?
Administrators should apply the patch released by Cisco and check their SEG configurations for potential vulnerabilities.