Cisco patches actively exploited Secure Email Gateway zero-day enabling root command execution
Summary
Cisco patched CVE-2026-76519, an actively exploited Secure Email Gateway flaw that can let unauthenticated attackers execute commands as root via a crafted email attachment. The company advises checking for compromise and upgrading affected systems.
Key points
- The relative path traversal flaw affects Cisco Secure Email Gateway's Advanced Malware Protection feature and can enable arbitrary file writes and root-level command execution.
- Attackers can exploit vulnerable devices by sending an email with a maliciously crafted attachment; authentication is not required.
- Affected systems have File Reputation enabled and Content Scanner Tools earlier than 25.3.0.5525.
- Admins can check the scanner version with the contentscannerstatus CLI command and verify File Reputation settings in mail policies.
- Cisco published compromise indicators and advises checking firewall and network logs for suspicious transfers; attackers may erase evidence.
- Cisco has applied mitigations to cloud instances and contacted owners where potential compromise was detected. Contacted customers should restore secure configurations, renew credentials and cryptographic materials, and restrict appliance access.
- Shadowserver tracks nearly 300 internet-exposed Cisco Secure Email Gateway instances, but does not say how many are honeypots or already secured.
Article Details
- Vulnerability Types
- Relative path traversal
- Affected Versions
- Cisco Secure Email Gateway with Content Scanner Tools versions earlier than 25.3.0.5525, when File Reputation is enabled and assigned to a mail policy
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- For contacted customers, Cisco recommends restoring the device to a secure configuration by renewing credentials and installed cryptographic materials when possible, and restricting appliance access with robust access controls.
MITRE ATT&CK
T1059 · Command and Scripting InterpreterSuccessful exploitation allows remote unauthenticated attackers to execute commands with root privileges.T1565.001 · Stored Data ManipulationAttackers send an email with a maliciously crafted attachment through an unpatched device, exploiting attachment handling.T1574.004 · Dylib HijackingThe relative path traversal flaw allows attackers to write arbitrary files on the underlying operating system.
CVE
People
Vendors
Products
Cisco AsyncOS Softwarecustomers to patch a new actively exploited SEG zero-day (CVE-2026-76461) in the email parsing of Cisco AsyncOS Software that also lets unauthenticated, remote attackers execute arbitrary commands with root privilegesCisco Secure Email GatewayInternet security watchdog Shadowserver tracks nearly 300 Cisco Secure Email Gateway instances exposed online, but it provides no information on how many are honeypots or have already been secured.Secure Email and Web Managerflaw (CVE-2025-20393) that attackers have exploited in zero-day attacks targeting SEG and Secure Email and Web Manager (SEWM) appliances since November 2025.