CVE-2026-76519
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: a vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an…
CISA federal remediation date Oct 17
Vulnerabilities · 5h ago
Cisco says attackers are actively exploiting CVE-2026-76519 in Secure Email Gateway, a flaw in the Advanced Malware Protection file-reputation path that can let a remote, unauthenticated sender write files and reach root commands on affected appliances. The vulnerable path is in Cisco AsyncOS systems with File Reputation enabled and an outdated Content Scanner Tools package.
The useful wrinkle is the fix path: Cisco says Content Scanner Tools 25.3.0.5525 or later can close the hole without a full AsyncOS upgrade or restart, while fixed AsyncOS builds are also available. In plain terms, the inspection engine that is supposed to judge attachments can become the entry point, so a malicious email can turn into appliance-level compromise before the gateway has a chance to block it.
For operators, the exposure sits on SEG instances with File Reputation turned on, including physical, virtual, and managed cloud deployments that still carry the old scanner package. Because exploitation is already in progress, this is one of those cases where the vulnerable trust boundary, not just the message content, is what keeps the risk live until the scanner layer is brought current.
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: a vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an…
CISA federal remediation date Oct 17
4 sources covering this story
Cisco make-me-root email bug exploited as a 0-day by unknown crims
Both Switchzilla and CISA sound the alarm
Kwetsbaarheid verholpen in Cisco Secure Email Gateway
Cisco heeft een kwetsbaarheid verholpen in Cisco Secure Email Gateway, specifiek in de Advanced Malware Protection feature.
Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability
Attackers exploit a Cisco Secure Email Gateway flaw enabling file writes without login when File Reputation is enabled and scanner tools are outdated.
Cisco patches new Secure Email Gateway zero-day exploited in attacks
Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges.
Part of the PlainSec briefing for 2026-10-14