Thursday 15 October 2026
Afternoon Edition
ZOTPAPER

News without the noise

ZOTPAPER
Security

Cisco warns of actively exploited email-to-root flaw in Secure Email Gateway

Second zero-day in the product in two months prompts CISA deadline for federal agencies

By LineZotpaper
Published
Updated
Read Time2 min
Sources2 outlets
Cisco is urging customers to patch a critical vulnerability in its Secure Email Gateway that attackers are already exploiting in the wild, using a malicious email to gain root access to the appliance without authentication.

The flaw, tracked as CVE-2026-76519, carries a CVSS severity score of 9.8 out of 10 and stems from improper handling of email attachments in the product's Advanced Malware Protection (AMP) feature. In advisories published Wednesday, Cisco and the US government said attackers had exploited the vulnerability before a fix was available. The US Cybersecurity and Infrastructure Security Agency (CISA) added the bug to its Known Exploited Vulnerabilities catalog and set a Saturday deadline for federal agencies to patch.

Cisco said it became aware of active exploitation in October. A spokesperson said the issue affects a limited number of customers but declined to say how many appliances had been compromised or what attackers were doing with the access they gained. The company said it strongly urges customers to upgrade to a fixed software release and follow hardening guidance in its advisory.

The vulnerability affects physical and virtual Secure Email Gateway appliances running vulnerable releases of Cisco AsyncOS Software when both of two conditions are met: the File Reputation service, part of AMP, is enabled and assigned to a mail policy, and Content Scanner Tools is earlier than version 25.3.0.5525. Cisco said there are no workarounds and recommends customers running releases earlier than v16.5 migrate to 16.5.0-780.

This is the second zero-day in the Secure Email Gateway in as many months. In mid-September, Cisco warned that criminals were exploiting a similar email-to-root bug tracked as CVE-2026-76461, and in January attackers exploited CVE-2025-20393, another AsyncOS flaw, to break into appliances and install persistence mechanisms. That bug eventually scored a perfect 10 on the CVSS scale.

§

Analysis

Why This Matters

  • Email security appliances sit at the network edge and handle all inbound mail, so root access can let attackers read, redirect or delete messages and move laterally inside a network.
  • The bug is being exploited before a fix was available, a sign attackers are moving quickly against internet-facing infrastructure.
  • Federal agencies face a Saturday deadline to patch, reflecting the severity rating assigned to the flaw.

Background

Email security gateways are high-value targets because they process every message entering an organisation. A remote, unauthenticated root compromise means an attacker needs no credentials and no user interaction beyond sending an email. Cisco has now dealt with three critical Secure Email Gateway flaws in under a year, two of them zero-days, all involving malicious email escalating to root access.

Key Perspectives

Cisco: Says the flaw affects a limited number of customers, no workarounds exist and upgrading to a fixed AsyncOS release is the only remedy. CISA: Has added the bug to its exploited vulnerabilities catalog and ordered federal agencies to patch by Saturday, treating it as an urgent national risk. Critics and security watchers: May note that Cisco has not disclosed how many appliances were compromised or what attackers did with root access, leaving customers to assess their exposure with limited information. The recurrence of the same attack pattern raises questions about the attachment-handling code in the AMP feature.

What to Watch

  • Whether Cisco publishes further detail on the scope of exploitation or attacker behaviour after the patch deadline passes.
  • How organisations that cannot patch immediately respond, given there are no workarounds.
  • Any further Secure Email Gateway advisories, after three critical flaws have been disclosed in less than a year.

Sources

Zotpaper

Written by software from the reporting listed above, scored by an automated standards desk, and published without a person reading it first. If something here is wrong, tell the editor and it will be put right.

How we workSubscribe