Story · 12 sources · 12 articlesfirst Oct 14, 16:00 UTCupdated Oct 15, 15:12 UTC (1d ago)

Cisco make-me-root email bug exploited as a 0-day by unknown crims

criticalExploit / PoCexploited in the wildimportance 90CVE-2026-76461 CVE-2025-20393 CVE-2026-76519 CVE-2026-76440 CVE-2026-0322 CVE-2024-20401

Merged summary · from the lead article

Attackers are exploiting Cisco Secure Email Gateway zero-day CVE-2026-76519 for unauthenticated root access via email.

Cisco and CISA warned that CVE-2026-76519, a CVSS 9.8 flaw in Secure Email Gateway, was exploited as a zero-day before a fix. Unauthenticated attackers can send a malicious email attachment and, when Advanced Malware Protection File Reputation is enabled and Content Scanner Tools are older than 25.3.0.5525, write files and execute commands as root on physical or virtual AsyncOS appliances. Cisco says a limited number of customers are affected, there is no workaround, and vulnerable releases should move to fixed software, with pre-16.5 systems migrated to 16.5.0-780. CISA added the bug to the KEV catalog with a Saturday federal deadline. It follows exploited SEG flaws CVE-2026-76461 and CVE-2025-20393.

CVE-2026-76519 is rated CVSS 9.8 and was exploited before a patch.
A malicious email attachment can write files and run commands as root.
Only SEG appliances with File Reputation enabled and old scanner tools are affected.
CISA added it to KEV and set a Saturday federal remediation deadline.
Cisco also cited prior SEG zero-days CVE-2026-76461 and CVE-2025-20393.

VendorsCisco Palo Alto Networks

ProductsCisco Secure Email Gateway Cisco AsyncOS Cisco Advanced Malware Protection AsyncOS Advanced Malware Protection Content Scanner Tools PAN-OS Cisco AMP Cisco Secure Email Cloud Secure Email and Web Manager Cisco Secure Email and Web Manager

OrganizationsCISA Cisco Palo Alto Networks Qualys CERT-EU Cisco PSIRT Shadowserver

Coverage timelineoldest first · each row is one article

Oct 14, 16:00 UTC · 2d ago
Cisco Security Advisories· 68
Cisco Secure Email Gateway Arbitrary File Write Vulnerability
Cisco Secure Email Gateway flaw lets unauthenticated attackers write files and run root commands via crafted attachments.
Oct 14, 17:29 UTC · 2d ago
BleepingComputer· 86
Cisco patches new Secure Email Gateway zero-day exploited in attacks
Cisco patched actively exploited Secure Email Gateway zero-day CVE-2026-76519 enabling unauthenticated root execution.
Oct 14, 18:38 UTC · 2d ago
The Hacker News· 86
Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability

Vulnerabilities in this storyAll →

CVE-2024-204019.82%
A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to…
published Jul 17, 2024· cisco secure email gateway
CVE-2025-2039310.032%
Improper Input Validation in Cisco Secure Email and Web Appliances Allows Root Commands

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2024-20401	A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to… A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to overwrite arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when file analysis and content filters are enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to replace any file on the underlying file system. The attacker could then perform any of the following actions: add users with root privileges, modify the device configuration, execute arbitrary code, or cause a permanent denial of service (DoS) condition on the affected device. Note: Manual intervention is required to recover from the DoS condition. Customers are advised to contact the Cisco Technical Assistance Center (TAC) to help recover a device in this condition. NVD description · AI analysis pending	9.8	2%		cisco secure email gateway	—	Jul 17, 2024
CVE-2025-20393	Improper Input Validation in Cisco Secure Email and Web Appliances Allows Root Commands CVE-2025-20393 is an improper input validation flaw (CWE-20) in Cisco Secure Email Gateway, Secure Email, AsyncOS software, and Web Manager appliances that lets attackers execute arbitrary commands with root privileges on the underlying operating system. The flaw is triggered when an affected appliance processes improperly validated input, though the CISA record does not specify the access vector or whether authentication is required. Successful exploitation yields full compromise of the appliance at the highest OS privilege level, which is significant because these devices sit in the email- and web-security path of enterprise networks. Organizations running these Cisco appliances are affected; CVSS has not yet been published and no public proof-of-concept is known. Exploitation is confirmed in the wild: CISA added the vulnerability to the KEV catalog on 2025-12-17, EPSS estimates a 29.9% chance of exploitation within 30 days (98th percentile), and ransomware use remains undetermined. Do: Apply the mitigations or updates Cisco specifies in its advisory for CVE-2025-20393 without waiting for a CVSS score; the CISA KEV entry directs users to vendor mitigations, applicable BOD 22-01 cloud-service guidance, or discontinuing use if mitigations are unavailable. Because this record contains no fixed-release details, check the Cisco PSIRT advisory for the exact patched AsyncOS and Web Manager versions before planning the upgrade. In the meantime, review appliance logs and configurations for signs of unexpected command execution or changes, since active exploitation is confirmed and ransomware use is still unknown.	10.0	32%	KEV	Cisco Secure Email Gateway / Secure Email Cisco AsyncOS Software Cisco Web Manager appliance	largeroughly tens of thousands of appliance deployments worldwide (exact installed base unpublished)	Dec 17, 2025 KEV Dec 17, 2025
CVE-2026-0322	Authenticated root RCE in Palo Alto PAN-OS management CVE-2026-0322 is a code-injection flaw (CWE-94) in the management interface of Palo Alto Networks PAN-OS that allows remote code execution. An authenticated attacker who can reach the management interface over the network can run arbitrary code with root privileges on the device. It affects PAN-OS on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series); Cloud NGFW and Prisma Access are not affected. Palo Alto notes that risk is reduced when management access is limited to trusted internal addresses, consistent with its deployment guidance. CISA added the issue to the Known Exploited Vulnerabilities catalog on 2026-10-14, and reporting describes active exploitation including as a zero-day; ransomware use is listed as unknown and no public proof-of-concept is known. CVSS 4.0 is 8.6 (high), with high privileges required but low attack complexity and full impact on the vulnerable system. Do: Restrict PAN-OS and Panorama management interfaces to trusted internal IP addresses only, and apply Palo Alto Networks patches per vendor guidance and CISA BOD 26-04. Because this is in the CISA KEV catalog with reported active exploitation, review management-plane access logs and host integrity for unexpected root-level activity, and follow CISA forensics triage requirements where the interface was reachable.	8.6	1%	KEV	Palo Alto Networks PAN-OS on PA-Series firewalls Palo Alto Networks PAN-OS on VM-Series firewalls Palo Alto Networks Panorama (virtual and M-Series)
CVE-2026-76440	Critical Path Traversal Flaws in Cisco Secure Email Gateway and Email/Web Manager CVE-2026-76440 groups multiple path traversal weaknesses (CWE Pillar CWE-23) found during Cisco's internal security review of Cisco Secure Email Gateway and Cisco Secure Email and Web Manager, addressed via software hardening releases. With a CVSS 3.1 base score of 9.8 (network vector, low attack complexity, no privileges, no user interaction), a remote unauthenticated attacker could craft requests that escape intended directory boundaries to read, modify, or delete files on the appliance, potentially leading to full confidentiality, integrity, and availability impact. Any organization running an affected version of these email perimeter appliances is exposed, particularly since these gateways are designed to be internet-facing. No public proof-of-concept exists, the flaw is not in the CISA Known Exploited Vulnerabilities catalog, and no exploitation has been reported to date. Because the bugs were internally discovered, technical detail is limited and defenders should prioritize patching rather than await exploit intelligence. Do: Apply the software hardening release identified in Cisco's advisory for both Cisco Secure Email Gateway and Cisco Secure Email and Web Manager as soon as maintenance windows allow, given the unauthenticated 9.8 rating. Restrict the web management interface to trusted admin networks or VPN so only SMTP ports are exposed to the internet. Review appliance logs for unexpected file access, anomalous admin activity, or unfamiliar file modifications that could indicate prior probing.	9.8	—		Cisco Secure Email Gateway Affected versions not enumerated in the advisory summary; fixed in Cisco's software hardening release for this CVE Cisco Secure Email and Web Manager Affected versions not enumerated in the advisory summary; fixed in Cisco's software hardening release for this CVE
CVE-2026-76461	Unauthenticated SQL Injection to Root RCE in Cisco Secure Email Gateway Cisco AsyncOS Software for Cisco Secure Email Gateway contains a SQL injection flaw (CWE-89) in its email parsing logic, caused by insufficient validation of message content. An unauthenticated, remote attacker can trigger it simply by sending a crafted email containing malicious SQL statements through an affected gateway, with no user interaction required. Successful exploitation allows arbitrary SQL execution that escalates to arbitrary operating-system command execution with root privileges, fully compromising the appliance and all mail flowing through it. Any organization running an affected version of Cisco Secure Email Gateway is impacted, and because these appliances sit on the inbound mail path they are inherently reachable over the network. There is no known public proof-of-concept, the flaw is not on the CISA KEV list, and no in-the-wild exploitation has been reported to date, though the CVSS 9.8 rating makes patching urgent. Do: Upgrade to the fixed AsyncOS release listed in the corresponding Cisco PSIRT advisory as soon as possible, since the flaw is unauthenticated, requires no user interaction, and yields root. Until patched, apply any Cisco-documented workarounds and tightly restrict which hosts can submit mail to the gateway where operationally feasible. Review mail and system logs on these appliances for anomalies such as SQL errors in parsing, unexpected processes, or unexplained outbound connections that could indicate exploitation attempts.	9.8	30%	KEV PoC ×3
CVE-2026-76519	Relative Path Traversal to Root RCE in Cisco Secure Email Gateway CVE-2026-76519 is a critical relative path traversal flaw (CWE-23, CVSS 9.8) in the Advanced Malware Protection feature of Cisco Secure Email Gateway. When the file reputation service is enabled, an unauthenticated remote attacker can send an email with a crafted attachment that the gateway mishandles. A successful attack can write arbitrary files on the underlying operating system and execute commands as root. Cisco Secure Email Gateway deployments that use this AMP/file reputation feature are affected; specific version ranges are not listed in the source data. CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2026-10-14, Cisco has urged customers to patch and check for compromise, and a public proof-of-concept reference exists; ransomware use is listed as unknown. Do: Apply Cisco's fixes or mitigations for CVE-2026-76519 immediately, and follow CISA BOD 26-04 (including forensics triage). Treat appliances with Advanced Malware Protection or file reputation enabled as potentially compromised: review for unexpected files and root-level command execution, and isolate or discontinue use if a vendor fix is unavailable.	9.8	2%	KEV PoC	Cisco Secure Email Gateway	—

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2024-20401

A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to…

A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to overwrite arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when file analysis and content filters are enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to replace any file on the underlying file system. The attacker could then perform any of the following actions: add users with root privileges, modify the device configuration, execute arbitrary code, or cause a permanent denial of service (DoS) condition on the affected device. Note: Manual intervention is required to recover from the DoS condition. Customers are advised to contact the Cisco Technical Assistance Center (TAC) to help recover a device in this condition.

NVD description · AI analysis pending

9.8

cisco secure email gateway

—

Jul 17, 2024

CVE-2025-20393

Improper Input Validation in Cisco Secure Email and Web Appliances Allows Root Commands

CVE-2025-20393 is an improper input validation flaw (CWE-20) in Cisco Secure Email Gateway, Secure Email, AsyncOS software, and Web Manager appliances that lets attackers execute arbitrary commands with root privileges on the underlying operating system. The flaw is triggered when an affected appliance processes improperly validated input, though the CISA record does not specify the access vector or whether authentication is required. Successful exploitation yields full compromise of the appliance at the highest OS privilege level, which is significant because these devices sit in the email- and web-security path of enterprise networks. Organizations running these Cisco appliances are affected; CVSS has not yet been published and no public proof-of-concept is known. Exploitation is confirmed in the wild: CISA added the vulnerability to the KEV catalog on 2025-12-17, EPSS estimates a 29.9% chance of exploitation within 30 days (98th percentile), and ransomware use remains undetermined.

Do: Apply the mitigations or updates Cisco specifies in its advisory for CVE-2025-20393 without waiting for a CVSS score; the CISA KEV entry directs users to vendor mitigations, applicable BOD 22-01 cloud-service guidance, or discontinuing use if mitigations are unavailable. Because this record contains no fixed-release details, check the Cisco PSIRT advisory for the exact patched AsyncOS and Web Manager versions before planning the upgrade. In the meantime, review appliance logs and configurations for signs of unexpected command execution or changes, since active exploitation is confirmed and ransomware use is still unknown.

10.0

32%

KEV

Cisco Secure Email Gateway / Secure Email
Cisco AsyncOS Software
Cisco Web Manager appliance

largeroughly tens of thousands of appliance deployments worldwide (exact installed base unpublished)

Dec 17, 2025

KEV Dec 17, 2025

CVE-2026-0322

Authenticated root RCE in Palo Alto PAN-OS management

CVE-2026-0322 is a code-injection flaw (CWE-94) in the management interface of Palo Alto Networks PAN-OS that allows remote code execution. An authenticated attacker who can reach the management interface over the network can run arbitrary code with root privileges on the device. It affects PAN-OS on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series); Cloud NGFW and Prisma Access are not affected. Palo Alto notes that risk is reduced when management access is limited to trusted internal addresses, consistent with its deployment guidance. CISA added the issue to the Known Exploited Vulnerabilities catalog on 2026-10-14, and reporting describes active exploitation including as a zero-day; ransomware use is listed as unknown and no public proof-of-concept is known. CVSS 4.0 is 8.6 (high), with high privileges required but low attack complexity and full impact on the vulnerable system.

Do: Restrict PAN-OS and Panorama management interfaces to trusted internal IP addresses only, and apply Palo Alto Networks patches per vendor guidance and CISA BOD 26-04. Because this is in the CISA KEV catalog with reported active exploitation, review management-plane access logs and host integrity for unexpected root-level activity, and follow CISA forensics triage requirements where the interface was reachable.

8.6

KEV

Palo Alto Networks PAN-OS on PA-Series firewalls
Palo Alto Networks PAN-OS on VM-Series firewalls
Palo Alto Networks Panorama (virtual and M-Series)

CVE-2026-76440

Critical Path Traversal Flaws in Cisco Secure Email Gateway and Email/Web Manager

CVE-2026-76440 groups multiple path traversal weaknesses (CWE Pillar CWE-23) found during Cisco's internal security review of Cisco Secure Email Gateway and Cisco Secure Email and Web Manager, addressed via software hardening releases. With a CVSS 3.1 base score of 9.8 (network vector, low attack complexity, no privileges, no user interaction), a remote unauthenticated attacker could craft requests that escape intended directory boundaries to read, modify, or delete files on the appliance, potentially leading to full confidentiality, integrity, and availability impact. Any organization running an affected version of these email perimeter appliances is exposed, particularly since these gateways are designed to be internet-facing. No public proof-of-concept exists, the flaw is not in the CISA Known Exploited Vulnerabilities catalog, and no exploitation has been reported to date. Because the bugs were internally discovered, technical detail is limited and defenders should prioritize patching rather than await exploit intelligence.

Do: Apply the software hardening release identified in Cisco's advisory for both Cisco Secure Email Gateway and Cisco Secure Email and Web Manager as soon as maintenance windows allow, given the unauthenticated 9.8 rating. Restrict the web management interface to trusted admin networks or VPN so only SMTP ports are exposed to the internet. Review appliance logs for unexpected file access, anomalous admin activity, or unfamiliar file modifications that could indicate prior probing.

9.8

—

Cisco Secure Email Gateway Affected versions not enumerated in the advisory summary; fixed in Cisco's software hardening release for this CVE
Cisco Secure Email and Web Manager Affected versions not enumerated in the advisory summary; fixed in Cisco's software hardening release for this CVE

CVE-2026-76461

Unauthenticated SQL Injection to Root RCE in Cisco Secure Email Gateway

Cisco AsyncOS Software for Cisco Secure Email Gateway contains a SQL injection flaw (CWE-89) in its email parsing logic, caused by insufficient validation of message content. An unauthenticated, remote attacker can trigger it simply by sending a crafted email containing malicious SQL statements through an affected gateway, with no user interaction required. Successful exploitation allows arbitrary SQL execution that escalates to arbitrary operating-system command execution with root privileges, fully compromising the appliance and all mail flowing through it. Any organization running an affected version of Cisco Secure Email Gateway is impacted, and because these appliances sit on the inbound mail path they are inherently reachable over the network. There is no known public proof-of-concept, the flaw is not on the CISA KEV list, and no in-the-wild exploitation has been reported to date, though the CVSS 9.8 rating makes patching urgent.

Do: Upgrade to the fixed AsyncOS release listed in the corresponding Cisco PSIRT advisory as soon as possible, since the flaw is unauthenticated, requires no user interaction, and yields root. Until patched, apply any Cisco-documented workarounds and tightly restrict which hosts can submit mail to the gateway where operationally feasible. Review mail and system logs on these appliances for anomalies such as SQL errors in parsing, unexpected processes, or unexplained outbound connections that could indicate exploitation attempts.

9.8

30%

KEV PoC ×3

CVE-2026-76519

Relative Path Traversal to Root RCE in Cisco Secure Email Gateway

CVE-2026-76519 is a critical relative path traversal flaw (CWE-23, CVSS 9.8) in the Advanced Malware Protection feature of Cisco Secure Email Gateway. When the file reputation service is enabled, an unauthenticated remote attacker can send an email with a crafted attachment that the gateway mishandles. A successful attack can write arbitrary files on the underlying operating system and execute commands as root. Cisco Secure Email Gateway deployments that use this AMP/file reputation feature are affected; specific version ranges are not listed in the source data. CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2026-10-14, Cisco has urged customers to patch and check for compromise, and a public proof-of-concept reference exists; ransomware use is listed as unknown.

Do: Apply Cisco's fixes or mitigations for CVE-2026-76519 immediately, and follow CISA BOD 26-04 (including forensics triage). Treat appliances with Advanced Malware Protection or file reputation enabled as potentially compromised: review for unexpected files and root-level command execution, and isolate or discontinue use if a vendor fix is unavailable.

9.8

KEV PoC

Cisco Secure Email Gateway

—