Skip to content
Critical Cisco Secure Email Gateway Vulnerability Exploited

Critical Cisco Secure Email Gateway Vulnerability Exploited

First seen 14 Oct 2026, 18:36 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 15, 2026 at 09:36 UTC
  • •CVE-2026-76519 allows root-level command execution via crafted email attachments.
  • •Active exploitation has been confirmed, affecting Cisco Secure Email Gateway appliances.
  • •Patches were released on October 14, 2026; immediate application is recommended.

Cisco has disclosed a critical vulnerability in its Secure Email Gateway (SEG), tracked as CVE-2026-76519, which allows unauthenticated remote attackers to execute commands with root privileges. This flaw arises from improper handling of email attachments when the File Reputation service is enabled. Active exploitation of this vulnerability has been confirmed, with attackers able to send crafted emails that compromise the system without user interaction. The vulnerability affects both physical and virtual appliances running vulnerable versions of Cisco AsyncOS, specifically those with Content Scanner Tools versions earlier than 25.3.0.5525. Cisco released patches on October 14, 2026, and has advised affected organizations to apply these updates immediately. The CVSS score for this vulnerability is 9.8, indicating a critical severity level. Organizations are urged to review their configurations to determine if they are at risk.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2024-07-17
CVE-2024-20401 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2025-12-17
CVE-2025-20393 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-14
CVE-2026-76519 disclosed
Cisco disclosed the vulnerability and released patches for affected AsyncOS versions.
Linkedin
2026-09-14
CVE-2026-76443 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-14
CVE-2026-76442 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-14
CVE-2026-20353 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-14
CVE-2026-76440 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-14
CVE-2026-76461 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-14
CVE-2026-76441 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-14
Active exploitation confirmed
Cisco reported active exploitation of the vulnerability in the wild, prompting immediate patch release.
Thehackernews

More articles in this cluster (13)

Following this threat?

Track CVE-2024-20401 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (19)

1 / 4

Common questions

Which Cisco products are affected?
The vulnerability affects Cisco Secure Email Gateway appliances running vulnerable AsyncOS versions with the File Reputation service enabled.
What is the CVSS score for this vulnerability?
The CVSS score for CVE-2026-76519 is 9.8, indicating a critical severity level.
What should organizations do to mitigate this risk?
Organizations should apply the patches released by Cisco immediately and review their configurations to ensure the File Reputation service is not exposing them to this vulnerability.