Cisco has patched a second actively exploited zero-day in its Secure Email Gateway (SEG) appliance in a month. The flaw, CVE-2026-76519 (CVSS 9.8), is a relative path traversal weakness in the Advanced Malware Protection feature’s handling of email attachments. An unauthenticated attacker who sends a specially crafted attachment through an unpatched gateway can write arbitrary files and run commands as root on the underlying operating system. Cisco’s advisory says its PSIRT became aware of exploitation in October 2026.
Only gateways with the File Reputation service enabled and assigned to a mail policy, and with Content Scanner Tools older than 25.3.0.5525, are vulnerable. Cisco has not said how many devices were attacked or who is behind the activity, and it found the flaw in its own internal scanning. Cisco has already deployed the fix to its managed Secure Email Cloud service and contacted customers whose cloud devices showed signs of compromise. The earlier SEG zero-day, CVE-2026-76461, was a separate email-parsing flaw; Shadowserver tracks nearly 300 SEG instances exposed online.
How to check if you’re affected
Affected products are physical and virtual Cisco Secure Email Gateway appliances (Secure Email and Web Manager and Secure Web Appliance are not affected). Both conditions must hold for a device to be vulnerable:
- File Reputation is enabled: in the web interface, open Mail Policies > Incoming Mail Policies (or Outgoing Mail Policies) > Advanced Malware Protection and look at the “Enable File Reputation” box for each policy.
- The Content Scanner Tools version is earlier than 25.3.0.5525: run
contentscannerstatusat the CLI.
The quickest fix is the scanner update to 25.3.0.5525 or later, which Cisco says applies without a software upgrade or restart; run contentscannerupdate if automatic updates are off. The full AsyncOS fix is in 15.5.5-014 and 16.5.0-780, and Cisco lists no fixed build for 16.0, so those gateways should migrate to a fixed release. There is no workaround.
To look for signs of exploitation, run grep "System Security" system_logs on each appliance. “Suspected compromise indicator was found” means contact Cisco TAC; “No compromise indicator was found” is not proof of safety, because an attacker with root could remove evidence. Also check firewall and network logs for unexpected uploads to or downloads from external addresses. For a compromised virtual appliance, Cisco’s guidance is a rebuild with new credentials; upgrading in place destroys forensic data.