Cisco Patches Actively Exploited Secure Email Gateway Zero-Day

Cisco has released emergency patches for a critical zero-day vulnerability affecting its Secure Email Gateway (SEG) appliances, which threat actors are actively exploiting in real-world attacks.

Tracked as CVE-2026-76519, the vulnerability carries severe risks because it allows remote, unauthenticated attackers to write arbitrary files and execute system commands with root privileges on underlying operating systems. The security flaw stems from a relative path traversal weakness within SEG’s Advanced Malware Protection (AMP) feature, triggered by improper handling of incoming or outgoing email attachments.

According to the company’s advisory, the security issue impacts SEG instances where the File Reputation service is enabled and assigned to an active mail policy, running a Content Scanner Tools version earlier than 25.3.0.5525. Administrators can verify their vulnerable status by running the contentscannerstatus command via the command-line interface and inspecting Advanced Malware Protection settings in the web management interface.

While specific details regarding active campaigns remain limited, Cisco urged network administrators to review firewall and network logs for suspicious inbound or outbound activity. Attackers may attempt to erase evidence of exploitation after securing root access on compromised machines. Cloud instances have already received automated mitigations, and administrators of impacted cloud devices with detected compromise indicators have been directly notified.

Organizations running vulnerable on-premise hardware should immediately verify Content Scanner Tools versions and apply official software updates. Network defenders are advised to restrict administrative access to management interfaces and renew cryptographic materials on any appliances exhibiting potential signs of compromise.