Vulnerabilities & Exploits · Zero-Day Exploit

Cisco SEG zero-day turns email into root access

Cisco says attackers are actively exploiting CVE-2026-76519 in Secure Email Gateway, a flaw in the Advanced Malware Protection file-reputation path that can let a remote, unauthenticated sender write files and reach root commands on affected appliances. The vulnerable path is in Cisco AsyncOS systems with File Reputation enabled and an outdated Content Scanner Tools package.

The useful wrinkle is the fix path: Cisco says Content Scanner Tools 25.3.0.5525 or later can close the hole without a full AsyncOS upgrade or restart, while fixed AsyncOS builds are also available. In plain terms, the inspection engine that is supposed to judge attachments can become the entry point, so a malicious email can turn into appliance-level compromise before the gateway has a chance to block it.

For operators, the exposure sits on SEG instances with File Reputation turned on, including physical, virtual, and managed cloud deployments that still carry the old scanner package. Because exploitation is already in progress, this is one of those cases where the vulnerable trust boundary, not just the message content, is what keeps the risk live until the scanner layer is brought current.

4 sources · Oct 14

CVE-2026-76519

NVD KEV

Known exploited · CISA KEV

CVSS 9.8 CRITICAL: a vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an…

CISA federal remediation date Oct 17

Timeline

Sources

Vendor digest: Cisco

Part of the PlainSec briefing for 2026-10-14

Every edition of this story: Cisco SEG zero-day turns email into root access

More from today