Cisco has patched a critical zero-day vulnerability in its Secure Email Gateway that is already being actively exploited, allowing unauthenticated attackers to execute commands with root privileges on affected appliances. The flaw, CVE-2026-76519, carries a CVSS score of 9.8 and was added to CISA's Known Exploited Vulnerabilities catalogue on 14 October 2026, the same day Cisco published its advisory.

How an attacker gets in

The vulnerability sits in the Advanced Malware Protection feature, where improper handling of email attachments allows a relative path traversal attack. An attacker needs only to send a maliciously crafted attachment through an affected device, with no credentials and no user interaction required. A successful exploit can write arbitrary files and execute commands as root on the underlying operating system. Two conditions must both be met: the File Reputation service must be enabled and assigned to a mail policy, and the Content Scanner Tools package must be older than version 25.3.0.5525. Cisco's Secure Email and Web Manager and Secure Web Appliance are not affected.

Fix now, and check for compromise

There are no workarounds. The fastest fix is updating Content Scanner Tools to version 25.3.0.5525 or later, which needs no software upgrade or restart, while a full fix is available in AsyncOS 15.5.5-014 or 16.5.0-780. CISA set a 17 October deadline for United States federal agencies, and CERT-EU followed on 15 October urging rapid fixes for internet-facing devices. Cisco says attackers with root access may hide evidence, so administrators should check for the "Suspected compromise indicator was found" log message and review network and firewall logs outside the device. This is the second Secure Email Gateway flaw exploited in about a month, after CVE-2026-76461 in September.

Sources: Help Net Security / Cisco advisory, Cloud Security Alliance Labs