Cisco has warned that attackers exploited a critical Secure Email Gateway flaw before a fix was available.
The Register reported that Cisco disclosed active exploitation of CVE-2026-76519, a vulnerability in Cisco Secure Email Gateway, or SEG, an appliance used to inspect and filter email before it reaches users. Cisco gave the flaw a CVSS severity score of 9.8 out of 10, according to the report.
The issue is significant because the attack path is unusually simple in the source account: a remote attacker does not need to log in first, and can trigger the flaw by sending a malicious email attachment. If exploitation succeeds, the attacker can write files and run commands with root privileges, which is the highest level of control on the underlying system.
What Cisco says the flaw does
According to The Register's coverage of Cisco's advisory, the flaw exists in SEG's Advanced Malware Protection feature, referred to as AMP, and is tied to improper handling of email attachments. In plain terms, that means the security feature that is supposed to inspect risky files can itself be abused by a specially crafted attachment.
The report says the vulnerability affects both physical and virtual SEG appliances running vulnerable Cisco AsyncOS releases, but only when two conditions are met. First, the File Reputation service, which is part of AMP, must be enabled and assigned to a mail policy. Second, the installed Content Scanner Tools version must be earlier than 25.3.0.5525.
Cisco told the publication that the flaw affects "a limited number of customers", but the company did not say how many appliances had been compromised or what attackers were doing after gaining access. That leaves the scale and follow-on activity uncertain based on the available source.
What organisations need to check
The source material says there are no workarounds. Cisco's stated remedy is to upgrade to a fixed Cisco AsyncOS Software release. For customers on releases earlier than version 16.5, the vendor recommends migrating to 16.5.0-780, according to The Register's report.
Cisco's advisory, as described in the report, also includes steps organisations can use to determine whether File Reputation is enabled and which Content Scanner Tools version is installed. That matters because the product is not described as universally exposed; the source ties exposure to a specific feature configuration and scanner-tool version.
For IT and security teams, the immediate response described by the source is practical rather than strategic: verify whether SEG is in scope, confirm the relevant settings, and move to the fixed release if the appliance is vulnerable. The article does not provide evidence of broader business adoption trends or resistance beyond Cisco's warning and patch guidance.
CISA has treated it as an active exploitation issue
The US Cybersecurity and Infrastructure Security Agency, or CISA, added the vulnerability to its Known Exploited Vulnerabilities catalogue, according to The Register. That catalogue is CISA's list of bugs the agency says are being exploited in the wild.
The same report says CISA set a Saturday deadline for federal agencies to fix the issue. The source does not say whether the deadline applies beyond US federal systems, but it does signal that the agency considers the risk urgent enough to require rapid remediation in government environments.
Cisco said it became aware of active exploitation in October. The article attributes the attacks to unknown criminals, but does not identify a group, campaign, or sector-specific target set.
This is not Cisco's first recent SEG zero-day
The Register also notes that this is the second zero-day affecting Cisco SEG in roughly two months. In mid-September, Cisco warned of another actively exploited SEG flaw, CVE-2026-76461, which the report describes as a similar bug that could also turn a malicious email into root access.
The source adds a longer recent history: in January, attackers exploited another critical AsyncOS flaw, CVE-2025-20393, to break into Cisco SEG appliances and install persistence mechanisms. Persistence mechanisms are ways for attackers to maintain access after the initial compromise.
This does not prove a single underlying cause across the cases, and the source does not claim one. But it does show a repeated pattern in which email security appliances themselves have been targeted in recent incidents described by the report.
Why it matters
What is established by the source is narrower than the surrounding alarm may suggest, but still serious: Cisco says CVE-2026-76519 was exploited before a fix was available, the attack can begin with a malicious email attachment, and successful exploitation can give an attacker root-level control of the appliance. CISA's decision to add the flaw to its Known Exploited Vulnerabilities catalogue reinforces that this is an active security problem rather than a theoretical one.
What the source does not establish is the scale of compromise, the attackers' follow-on actions, or whether any particular sector was targeted. The strongest conclusion supported by these reports is that organisations using Cisco Secure Email Gateway should treat the issue as a configuration-specific but urgent patching case, and more broadly as a reminder that security appliances themselves can become the entry point if they are left exposed.