Cisco has urged users to patch a critical zero-day vulnerability allowing remote unauthenticated attackers to exploit its Secure Email Gateway after spotting exploitation in the wild, and CISA was hot on its heels.
The CVSS 9.8-rated arbitrary file write vulnerability CVE-2026-76519 was added to the US cybersecurity agency’s Known Exploited Vulnerability (KEV) catalogue on Wednesday, shortly after Cisco first released a patch.
Cisco’s advisory said: “An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.”
See also: AI is writing patches, how much should we trust them?
The bug affects both the physical and virtual versions of Secure Email Gateway, running with a vulnerable release of Cisco’s AsyncOS software, with the file reputation service enabled and assigned to a mail policy, and using a version of the Content Scanner Tools earlier than 25.3.0.5525.
Secure Email Gateway is Cisco’s email protection platform used to detect and block threats such as phishing, business email compromise, spam, and data loss, and provide encryption for outgoing emails.
Verifying exploitation
Cisco said potentially impacted users can review system_logs to verify attempted exploitation, advising them to review the logs of each cluster device if the device is part of a cluster.
Exploitation would be indicated by either the log message “Suspected compromise indicator was found. Contact TAC for further recommendations,” or “Security scan did not complete. Contact TAC for further recommendations.”
There are no workarounds for protection, meaning users must upgrade to releases 15.5.5 - 014 or 16.5.0 - 780 to mitigate the vulnerability. CISA gave government organisations until 17 October to update their software.
CVE-2026-76519 is the second critical vulnerability to affect the Secure Email Gateway in a month after SQL Injection bug CVE-2026-76461, also CVSS 9.8-rated, was disclosed in mid-September.
The Stack keeps its security reporting free for public interest purposes. You can support our independent journalism and grab a 50% discount to tickets for our events by subscribing for $300/year.
