A newly discovered flaw in Cisco’s Secure Email Gateway (SEG) has been exploited by attackers before the company issued a fix, prompting warnings from both Cisco and the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The vulnerability, identified as CVE‑2026‑76519 and rated 9.8 on the CVSS scale, allows an unauthenticated remote attacker to write files and execute commands with root privileges on the appliance by simply sending a malicious email. Cisco described the issue as affecting a limited number of customers and urged immediate patching. CISA added the flaw to its Known Exploited Vulnerabilities catalog and set a Saturday deadline for federal agencies to remediate it.

The bug resides in the SEG’s Advanced Malware Protection (AMP) feature and stems from improper handling of email attachments. Exploitation requires two conditions: the File Reputation service must be enabled and assigned to a mail policy, and the Content Scanner Tools version must be earlier than 25.3.0.5525. Affected devices include both physical and virtual SEG appliances running vulnerable releases of Cisco AsyncOS Software. Cisco provided guidance on how to verify these settings and recommended upgrading to a fixed AsyncOS release, specifically version 16.5.0-780 or later, as the only remediation path.

Cisco’s security team confirmed awareness of active exploitation dating back to October, marking the second zero‑day in the SEG product line within two months. A prior flaw, CVE‑2026‑76461, was disclosed in September and similarly enabled root access via malicious email attachments. Earlier in the year, another critical AsyncOS vulnerability, CVE‑2025‑20393, was leveraged to install persistence mechanisms on compromised SEG appliances. The company has not disclosed the number of affected devices or details of attacker activity beyond confirming that exploitation is occurring. Organizations are advised to apply the recommended patches promptly and follow the hardening measures outlined in Cisco’s advisory.