Cisco Secure Email Gateway flaw exploited through a simple email attachment

Cisco on October 14 published a critical security advisory for Secure Email Gateway (SEG), its email filtering gateway. The flaw, tracked as CVE-2026-76519 and rated 9.8 out of 10, is already being exploited. The vendor says its Product Security Incident Response Team (PSIRT) became aware of "active exploitation" in October. The same day, the US cybersecurity agency CISA added it to its Known Exploited Vulnerabilities (KEV) catalog.

One email is enough

This is a path traversal flaw (directory traversal) in how the File Reputation feature of the Advanced Malware Protection (AMP) module processes attachments. According to Cisco, an unauthenticated remote attacker could send an email with a booby-trapped attachment through the device, write arbitrary files to the system and run commands with root privileges. No user action is required.

Two conditions must be met: File Reputation is enabled and tied to a mail policy, and the Content Scanner Tools component is older than version 25.3.0.5525. Both physical and virtual appliances are affected. Secure Email and Web Manager and Secure Web Appliance are not. For the cloud service Secure Email Cloud Gateway, Cisco applied mitigations and says no action is required. The vendor contacted cloud customers directly when their devices showed malicious activity.

Cisco does not say how many victims there are or who the attackers are. According to BleepingComputer, the Shadowserver organization tracks nearly 300 SEG instances exposed on the internet. That figure does not distinguish devices that have already been patched.

What to do

• Check your exposure: the contentscannerstatus command shows the Content Scanner Tools version. In the web interface, check whether "Enable File Reputation" is ticked in the incoming and outgoing policies (Mail Policies, Advanced Malware Protection).
• Patch: update Content Scanner Tools to 25.3.0.5525 or later, using contentscannerupdate or automatic updates. No AsyncOS upgrade or reboot is needed. On the AsyncOS side, the fixed releases are 15.5.5-014 and 16.5.0-780. The 16.0 branch must migrate, and Cisco recommends 16.5.0-780 for any release earlier than 16.5.
• Hunt for compromise: run grep "System Security" system_logs on each member of a cluster. The message "Suspected compromise indicator was found" means you must contact support (TAC).
• If a virtual appliance is compromised, Cisco asks you to preserve forensic data first, because the update destroys it. Then deploy a new, patched virtual machine, rebuild the configuration without importing the old one, and rotate credentials and cryptographic material. In a cluster, all members must be restored, because SSH keys may have been exposed.
• Check network logs: an attacker with root access can erase their traces on the device. Cisco advises looking for unusual transfers to external addresses in firewall logs.

A regular target

According to BleepingComputer, other flaws in this product line have been actively exploited in recent months. CVE-2025-20393 was exploited from November 2025 and was patched in January 2026. CVE-2026-76461 followed in September 2026. By design, these gateways receive email from any sender, which makes them a prime entry point.