Cisco patches new Secure Email Gateway zero-day exploited in attacks
Cisco patched actively exploited Secure Email Gateway zero-day CVE-2026-76519 enabling unauthenticated root execution.
Cisco patched CVE-2026-76519, a relative path traversal in Secure Email Gateway Advanced Malware Protection that lets unauthenticated remote attackers write arbitrary files and execute root commands by sending a crafted email attachment. Vulnerable instances have File Reputation enabled on a mail policy and Content Scanner Tools earlier than 25.3.0.5525. Cisco said exploitation was observed in October 2026, published compromise indicators, deployed cloud mitigations, and contacted some Secure Email Cloud owners. Shadowserver tracks nearly 300 exposed SEG instances. The report also cites earlier SEG flaws CVE-2024-20401, CVE-2025-20393, and CVE-2026-76461.