Signal is active with 40 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-10-17. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Priority
LOW
Exploitation
ACTIVE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 7 products
‼️ WARNING - Cisco confirms active, in-the-wild exploitation of a new critical flaw (CVE-2026-76519 // CVSS 9.8) in Cisco Secure Email Gateway. Unauthenticated attackers can achieve full root command execution simply by sending an email with a crafted attachment. Details >> https://thehackernews.com/2026/10/cisco-warns-of-active-attacks.html
🚨 BREAKING: Cisco says attackers are exploiting a new zero-day in its Secure Email Gateway. CVE-2026-76519 lets an unauthenticated attacker run commands as root by sending an email with a crafted attachment. It is the second gateway zero-day Cisco has patched this month. https://t.co/WROjlrpg9v
🚨 CISA ADDS EXPLOITED CISCO SECURE EMAIL GATEWAY FLAW TO KEV (CVE-2026-76519, CVSS 9.8) CISA added CVE-2026-76519 to its Known Exploited Vulnerabilities catalog on Oct 14, 2026, with a federal remediation due date of Oct 17. Cisco published its advisory the same day for an arbitrary file write flaw in the AMP (Advanced Malware Protection) feature of Cisco Secure Email Gateway, and Cisco PSIRT says it became aware of active exploitation in October 2026. What Cisco says: • An unauthenticated, remote attacker sends an email with a crafted attachment through the appliance • Success lets the attacker write files and run commands as root on the underlying OS • Physical and virtual appliances are affected when File Reputation is enabled in a mail policy and Content Scanner Tools is earlier than 25.3.0.5525 • Fix: Content Scanner Tools 25.3.0.5525+ (no restart needed), or AsyncOS 15.5.5-014 / 16.5.0-780 • No workarounds • Cisco Secure Email Cloud: already patched by Cisco; customers with signs of compromise were contacted directly Check for compromise: grep "System Security" system_logs on every appliance (each cluster member). ⚠️ Analyst Note: On a suspected compromised virtual appliance, save forensic data first: Cisco warns upgrading destroys logs, and recommends rebuilding on a fresh VM without importing the old config and rotating credentials and keys. Cluster SSH keys may be exposed, so restore every member of an affected cluster. Neither Cisco nor CISA has shared attack scale or attribution. Sources: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp https://www.cisa.gov/known-exploited-vulnerabilities-catalog #DDW #Cisco #KEV #Vulnerability #EmailSecurity #CyberSecurity
🚨 Cisco confirma 0-day activo en Secure Email Gateway (CVE-2026-76519). Un email con adjunto manipulado → root en el appliance. Sin autenticación. Ya en KEV de CISA. Actualiza YA a AsyncOS 15.5.5-014 / 16.5.0-780. #Cisco #0day #Ciberseguridad https://t.co/dAy88wVVGg
Your Cisco email gateway can be turned into a root shell by one crafted attachment. Already exploited. CISA put it on the known-exploited list today with a three-day deadline. If AMP File Reputation is on, update Content Scanner Tools tonight. https://hol.org/blog/cve-2026-76519-cisco-secure-email-gateway-amp-file-write-kev https://t.co/QizjOz3fRW
🆘 VAROITUS: Cisco Secure Email Gateway -tuotteessa kriittinen hyväksikäytetty haavoittuvuus 🆘 Lue lisää: https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuus-2026-36 Hyväksikäyttö: Haavoittuvuuden hyväksikäyttöä on havaittu. Korjaus: Päivitä laitteeseen korjattu ohjelmistoversio. https://nvd.nist.gov/vuln/detail/cve-2026-76519 Lisätietoa myös Ciscon sivuilta: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp
【最新セキュリティインシデントまとめ更新（2026年10月）】 WAF製品「SiteGuard」の悪用確認ゼロデイ（CVE-2026-106931）、アエナECアプリ（最大81万人閲覧）、静岡市など自治体防災メール（アルカディア委託先）、マツダ、イズミ、トランスコスモス、Cisco SEGゼロデイ（CVE-2026-76519）、米DOJによる北朝鮮ノートPCファーム摘発など、10月14日公表の最新事案を追記しました。 https://thinktwice.tech/posts/6b004bae377cfc98ce01815af54e25ca/
News: Cisco Secure Email Gateway zero-day under attack. One crafted email attachment gives an attacker root, no login (CVE-2026-76519). Hit if File Reputation is on and Content Scanner Tools is below 25.3.0.5525. Patch today, then check firewall logs. https://www.bleepingcomputer.com/news/security/cisco-patches-actively-exploited-secure-email-gateway-zero-day/
Cisco Secure Email Gatewayにゼロデイ 脆弱性「CVE-2026-76519」、サイバー攻撃で悪用 https://rocket-boys.co.jp/security-measures-lab/cisco-secure-email-gateway-cve-2026-76519/ #セキュリティ対策Lab #security #securitynews #セキュリティ #セキュリティニュース
#Cisco has released software update for Secure Email Gateway to address a critical Arbitrary File Write vulnerability. #CVE-2026-76519 https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp
Attackers are exploiting CVE-2026-76519 (CVSS 9.8), a critical Cisco Secure Email Gateway vulnerability allowing root RCE via attachments. Patch right now. #CVE202676519 #Cisco #EmailSecurity #AsyncOS #RCE #ZeroDay #Cybersecurity https://securityonline.info/cisco-secure-email-gateway-cve-2026-76519-exploited/
Cisco patched CVE-2026-76519, an actively exploited zero-day in Secure Email Gateway (SEG) that vuln allows unauthenticated attackers to write files and execute commands as root via path traversal in Advanced Malware Protection attachment handling
ARETIQ Daily Vulnerability Bulletin — October 14, 2026 🔴 CRITICAL: CVE-2026-76519 (cisco/cisco_secure_email) AAS 13.4 22 vulnerabilities — CRITICAL: 1, HIGH: 21 Full bulletin: https://aretiq.ai/bulletins/2026-10-14/
Cisco patched CVE-2026-76519, an actively exploited Secure Email Gateway flaw that can let unauthenticated attackers execute commands as root via a crafted email attachment. The company advises checking for compromise and upgrading affected systems. https://cyber.hendryadrian.com/article/3055/cisco-patches-actively-exploited-secure-email-gateway-zero-day-enabling-root-command-execution
CVE-2026-76519: Κρίσιμη ευπάθεια στο Cisco Secure Email Gateway https://www.secnews.gr/740501/cve-2026-76519-cisco-email-gateway/?fsp_sid=19007
סיסקו מפרסמת תיקון לחולשת Zero-Day קריטית שמנוצלת בפועל נגד ארגונים. החולשה, CVE-2026-76519, ב-Cisco Secure Email Gateway מאפשרת לתוקף לשלוח מייל עם קובץ מצורף זדוני, ולהריץ פקודות עם הרשאות Root. סיקו מדווחת כי החולשה מנוצלת ולקוחות שנפגעו קיבלו עדכון מהחברה. https://t.me/CyberSecurityIL/9679
CISA flags exploited flaws in Palo Alto, Cisco and Ahsay products www.helpnetsecurity.com/2026/10/15/cve-2026-0322-cve-2026-76519-cve-2026-105133-cve-2026-105134-exploted/ https://t.co/hyQVnDGMcg
CISA flags exploited flaws in Palo Alto, Cisco and Ahsay products - https://www.helpnetsecurity.com/2026/10/15/cve-2026-0322-cve-2026-76519-cve-2026-105133-cve-2026-105134-exploted/ - @CISAgov @HuntressLabs - #CISA #Vulnerabilities #PaloAltoNetworks #Cisco #Ahsay #CVE #Cybersecurity #CyberSecurityNews #SecurityNews
🚨 @Cisco Secure Email Gateway CVE-2026-76519 (CVSS 9.8) is under active attack. A crafted email attachment can give unauthenticated attackers root-level command execution. @CISAgov KEV-listed. Fixes available. No workaround. Details in first reply. 👇 https://t.co/GHVUwgl8kl
Cisco corrige falha zero-day crítica no Secure Email Gateway https://sempreupdate.com.br/cisco-corrige-zero-day-secure-email-gateway-cve-2026-76519/
7 of 7 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | cisco | asyncos | - | - | - |
| HW | cisco | secure_email_gateway_c195 | - | - | - |
| HW | cisco | secure_email_gateway_c395 | - | - | - |
| HW | cisco | secure_email_gateway_c695 | - | - | - |
| App | cisco | secure_email_gateway_virtual_appliance_c100v | - | - | - |
| App | cisco | secure_email_gateway_virtual_appliance_c300v | - | - | - |
| App | cisco | secure_email_gateway_virtual_appliance_c600v | - | - | - |