Vulnerabilities & Exploits · Zero-Day Exploit

Cisco Secure Email Gateway flaw can spread in clusters

Cisco said on 14 October 2026 that CVE-2026-76519 in Secure Email Gateway is being actively exploited, and the flaw can let an unauthenticated attacker write files and run commands as root on affected appliances. CERT-EU said the issue affects the AMP file-reputation path in Cisco Secure Email Gateway when the Content Scanner Tools package is older than 25.3.0.5525.

The bug is a relative path traversal in how the gateway handles a crafted email attachment. If the file-reputation feature is enabled, a malicious message can steer the appliance into writing where it should not, turning mail inspection into full device compromise. On clustered gateways, Cisco says that compromise may expose private SSH keys used between members, which can let an attacker move into other nodes and hide evidence on the way.

That makes the trust boundary the appliance itself: a mail filter that sits in front of the inbox can become a foothold into the mail-security cluster. For any organization running internet-reachable Secure Email Gateway appliances, the remaining exposure is broader than one box if cluster credentials or shared trust material were already reachable from the device.

4 sources · 18h ago

CVE-2026-76519

NVD KEV

Known exploited · CISA KEV

CVSS 9.8 CRITICAL: a vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an…

CISA federal remediation date Oct 17

Timeline

Sources

Vendor digest: Cisco

Part of the PlainSec briefing for 2026-10-16

Every edition of this story: Cisco Secure Email Gateway flaw can spread in clusters

More from today