Cisco has released a security update to address an exploited zero-day vulnerability in Secure Email Gateway (SEG) appliances, which could allow remote, unauthenticated attackers to write files and execute commands with root privileges on the underlying operating system.
The vulnerability is tracked as CVE-2026-76519 and stems from a relative path traversal weakness in the Advanced Malware Protection (AMP) feature, resulting from improper handling of email attachments. According to Cisco’s description, exploitation requires only sending a specially crafted attachment through an unpatched appliance.
Who is affected by the vulnerability?
SEG instances are affected when the File Reputation service is enabled and assigned to a mail policy, and when the Content Scanner Tools version is older than 25.3.0.5525. Administrators can verify the version by using the contentscannerstatus command through the CLI, then review the Enable File Reputation option in the inbound or outbound mail policies under the Advanced Malware Protection section.
Active exploitation and indicators of compromise
Cisco said that its PSIRT incident response team learned in October 2026 of active exploitation of the vulnerability, but it did not publish additional details about the attacks or the parties behind them. Instead, the company provided indicators of compromise associated with system messages, including suspected detection of an indicator of compromise, an incomplete security scan, or no indicator being found.
In cases where evidence of compromise appears or the scan fails, Cisco recommends contacting the Technical Assistance Center (TAC). However, a message stating that no indicators of compromise were found does not eliminate the need to upgrade to a fixed version when one becomes available.
What should system administrators do?
Cisco warned that an attacker who gains command execution with root privileges may remove traces of exploitation. Therefore, it recommended reviewing firewall and network logs for downloads, uploads, and connections to external or suspicious IP addresses. The company also asked customers it contacted to return the appliance to a secure configuration and, where possible, renew the credentials and cryptographic material installed on the appliance, while restricting access to the appliance and applying strong access-control mechanisms.
Why does this matter?
The severity of the vulnerability lies in the combination of three factors: no authentication is required, it can be exploited through an email attachment, and it provides root privileges. It also comes amid a series of exploited vulnerabilities affecting Cisco’s email security products, making version verification and log inspection urgent actions rather than merely routine updates.
Shadowserver monitors approximately 300 Cisco Secure Email Gateway instances exposed to the internet, with no available information identifying how many devices are honeypots or have already been secured. Cisco had addressed another SEG vulnerability, CVE-2024-20401, in July 2024, and then fixed a critical AsyncOS vulnerability, CVE-2025-20393, in January, which had been exploited since November 2025. Last month, the company warned of another zero-day vulnerability in email analysis, CVE-2026-76461, which likewise allows command execution with root privileges.