Cisco email gateway hit by actively exploited zero-day flaw
Key takeaways
- A critical Cisco Secure Email Gateway flaw rated 9.8 CVSS was exploited before patches became available
- This is the second zero-day targeting the same product in two months
Cisco has warned customers of a zero-day vulnerability in its Secure Email Gateway (SEG) that allows remote attackers to achieve root access on appliances by sending a malicious email. In separate Wednesday advisories, both Cisco and CISA warned that attackers were exploiting the vulnerability before Cisco issued a fix.
The vulnerability, tracked as CVE-2026-76519, carries a severity rating of 9.8 out of 10 on the CVSS scale. The flaw exists in SEG's Advanced Malware Protection (AMP) feature and stems from improper handling of email attachments. An attacker can exploit the bug by sending an email with a malicious attachment; if specific conditions are met on the target appliance, the exploit succeeds, allowing the attacker to write files and execute commands with root privileges on the operating system.
A Cisco spokesperson told The Register the flaw affects "a limited number of customers" but declined to specify how many appliances had been compromised or what attackers were doing with their root-level access once inside. Cisco became aware of active exploitation in October and issued a fixed software release to remedy the issue.
What the numbers show
CISA added the flaw to its Known Exploited Vulnerabilities catalog and established a Saturday deadline for federal agencies to fix the issue.
The vulnerability requires two specific conditions to be exploitable: File Reputation service must be enabled and assigned to a mail policy, and Content Scanner Tools version must be earlier than 25.3.0.5525. The flaw stems from a relative path traversal weakness in the AMP feature caused by improper handling of email attachments.
Pattern of flaws
This marks the second zero-day in Cisco SEG within two months. Last month, criminals were exploiting CVE-2026-76461, a similar vulnerability that also permitted root access via malicious email. Earlier still, in January, attackers exploited CVE-2025-20393, another critical AsyncOS flaw that eventually scored a perfect 10 on the CVSS scale.
Why email gateways matter
Email gateways sit at the perimeter of networks, handling traffic from the outside world before it reaches internal systems. Root access on such an appliance grants attackers significant control over network traffic and potential persistence mechanisms.
The flaw is a straightforward coding error that unauthenticated attackers can trigger remotely by sending a specially crafted email, provided File Reputation is enabled and Content Scanner Tools is below 25.3.0.5525.
Impact and response requirements
Security teams managing Cisco SEG deployments face immediate pressure. Those running vulnerable AsyncOS versions earlier than 16.5 must migrate to 16.5.0-780 to apply the fix. Organisations where File Reputation is enabled face the highest risk. Federal agencies face a strict timeline, with CISA's Saturday deadline creating an urgent compliance obligation.
Upgrading to a fixed Cisco AsyncOS Software release will patch the security hole. There are no workarounds, meaning organisations cannot reduce risk without upgrading.
Cisco's advisory includes steps organisations can take to determine whether File Reputation is enabled and which Content Scanner Tools version is installed. Organisations should also review email gateway logs and firewall records for signs of exploitation or suspicious activity, including downloads and uploads to external or suspicious IP addresses.
What to do about it
Organisations running Cisco SEG must determine immediately whether File Reputation is enabled and which Content Scanner Tools version is installed. Those running vulnerable versions should prioritise upgrading to AsyncOS 16.5.0-780 or later.
Parallel to patching, teams should review email gateway logs for signs of exploitation. Attackers probing the vulnerability before the patch was available may have left traces. Any appliances showing suspicious attachment handling or unexpected outbound connections warrant investigation.
As a broader measure, organisations should implement defence-in-depth strategies that do not rely solely on the email gateway for malware detection. Sandboxing solutions and post-delivery threat detection reduce the impact if a gateway is compromised.
Cisco has already deployed mitigations on cloud instances and contacted Cisco Secure Email Cloud device owners where evidence of potential compromise was found. The company recommends that customers who have been contacted restore devices to secure configurations by renewing credentials and cryptographic materials installed on the appliance.
The concentration of critical flaws in Cisco SEG appliances within a short timeframe suggests organisations should audit all email gateway and perimeter security appliances across their infrastructure.
