Cisco warns of attacks exploiting critical Secure Email Gateway flaw for root access

Cisco has warned that attackers are actively exploiting a critical vulnerability in its Secure Email Gateway (SEG) appliances that allows an unauthenticated sender to run commands with root privileges, according to BleepingComputer and The Hacker News. Tracked as CVE-2026-76519 and rated CVSS 9.8, the flaw is triggered simply by sending an email with a crafted attachment to a vulnerable gateway, making it a high-priority patch for any organization that relies on the appliance to filter mail.

What happened

According to The Hacker News, Cisco discovered the flaw through internal security testing and became aware of exploitation in October 2026. The company published its advisory on Wednesday, October 14. Cisco has not said how many devices were hit, who is behind the attacks, or whether attackers obtained root access on specific systems, both outlets reported.

The Hacker News said the fix had in fact already shipped in a September 14 hardening release; Cisco now says that release covered this flaw as well. Cisco also stated that the September SQL injection bug in AsyncOS email parsing, CVE-2026-76461, is being exploited, although the outlet noted Cisco has not linked the two attack waves. This is the third root-level SEG flaw Cisco has confirmed as exploited since December 2025, following CVE-2025-20393, which was used by the China-linked UAT-9686 group.

Technical details

BleepingComputer describes the bug as a relative path traversal in the Advanced Malware Protection (AMP) feature, caused by improper handling of email attachments. A device is vulnerable only if both conditions are met:

• The File Reputation service is enabled and assigned to an incoming or outgoing mail policy.
• Content Scanner Tools is older than 25.3.0.5525.

Physical and virtual gateways are affected. According to The Hacker News, Secure Email and Web Manager and Secure Web Appliance are not.

Who is affected

The Shadowserver Foundation tracks nearly 300 internet-exposed SEG instances, BleepingComputer reported, without specifying how many are honeypots or already secured. Cisco said it deployed mitigations on cloud instances and contacted Secure Email Cloud customers whose devices showed indicators of possible compromise.

What to do

There is no workaround. Administrators should check the scanner version with the contentscannerstatus CLI command and update Content Scanner Tools to 25.3.0.5525 or later, which installs without a restart. Fixed AsyncOS builds are 15.5.5-014 and 16.5.0-780; AsyncOS 16.0 has no fixed build and should be migrated, according to The Hacker News.

To look for compromise, Cisco recommends running grep "System Security" system_logs on every cluster member. Because attackers with root access can delete evidence, a clean result does not rule out compromise, and firewall and network logs should be reviewed for unexpected uploads or downloads. Cisco advises rebuilding compromised virtual appliances on a fixed release without importing the old configuration, renewing credentials and cryptographic material, and restoring every member of an affected cluster. Upgrading a compromised instance in place destroys forensic data, the company warned.