--- title: Cisco patches actively exploited Secure Email Gateway... description: Cisco has patched CVE-2026-76519, a critical (CVSS 9.8) zero-day in Secure Email Gateway's Advanced Malware Protection feature that was already being exploited... canonical: https://daily.dev/posts/cisco-patches-actively-exploited-secure-email-gateway-zero-day-cve-2026-76519-pn2wa0jcf twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Cisco patches actively exploited Secure Email Gateway zero-day CVE-2026-76519 | daily.dev og:description: Cisco has patched CVE-2026-76519, a critical (CVSS 9.8) zero-day in Secure Email Gateway's Advanced Malware Protection feature that was already being exploited... og:url: https://daily.dev/posts/cisco-patches-actively-exploited-secure-email-gateway-zero-day-cve-2026-76519-pn2wa0jcf og:image: https://api.daily.dev/og/posts/Pn2Wa0JCf.png og:image:alt: Cisco patches actively exploited Secure Email Gateway zero-day CVE-2026-76519 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Cisco patches actively exploited Secure Email Gateway zero-day CVE-2026-76519 **[Collections](https://daily.dev/sources/collections)** · 2 min read · 0 upvotes · 0 comments ## Summary Cisco has patched CVE-2026-76519, a critical (CVSS 9.8) zero-day in Secure Email Gateway's Advanced Malware Protection feature that was already being exploited in the wild. The relative path traversal flaw lets an unauthenticated attacker send a malicious email attachment, write arbitrary files, and execute commands as root on both physical and virtual SEG appliances. Affected systems run AsyncOS with File Reputation enabled and Content Scanner Tools earlier than 25.3.0.5525. There is no workaround; admins must upgrade to AsyncOS 16.5.0-780 or later, check logs against published indicators of compromise, and renew credentials on compromised devices. CISA added the flaw to its Known Exploited Vulnerabilities catalog with a patch deadline for federal agencies. This is the third actively exploited SEG zero-day Cisco has faced in about a year, following CVE-2025-20393 and CVE-2026-76461. ## Content Cisco has patched CVE-2026-76519, a critical zero-day in Secure Email Gateway (SEG) that attackers were already exploiting. The flaw has a CVSS score of 9.8 and sits in the Advanced Malware Protection feature. ## What the bug does It is a relative path traversal weakness caused by improper handling of email attachments. An unauthenticated remote attacker can send a malicious attachment and write arbitrary files on the appliance, then run commands as root. Both physical and virtual SEG appliances are affected. The flaw applies to AsyncOS releases with File Reputation enabled and Content Scanner Tools versions earlier than 25.3.0.5525. ## What to do There is no workaround. Cisco's fix is to upgrade to AsyncOS 16.5.0-780 or later. Cisco has published indicators of compromise and wants admins to check their logs for suspicious activity. On any device that was compromised, it recommends renewing credentials. CISA added the flaw to its Known Exploited Vulnerabilities catalog and gave federal agencies until Saturday to patch. ## Not the first time This is the third actively exploited SEG zero-day Cisco has dealt with in about a year. The earlier two were CVE-2025-20393, a perfect-10 bug exploited in January, and CVE-2026-76461, exploited in September. Cisco hasn't said who is behind the attacks. ## Questions this post answers ### What is CVE-2026-76519 and how is it being exploited? CVE-2026-76519 is a critical zero-day (CVSS 9.8) in Cisco Secure Email Gateway's Advanced Malware Protection feature, caused by a relative path traversal flaw in attachment handling. An unauthenticated attacker can send a malicious email attachment to write arbitrary files on the appliance and then execute commands as root. Both physical and virtual SEG appliances running AsyncOS with File Reputation enabled are affected, and attackers were already exploiting it before the patch. _Teams running Cisco email gateways follow exploited CVE disclosures like this one on daily.dev to patch before attackers strike._ ### How do I fix CVE-2026-76519 on Cisco Secure Email Gateway? Upgrade to AsyncOS 16.5.0-780 or later, since there is no workaround for this vulnerability. Affected systems are those with Content Scanner Tools versions earlier than 25.3.0.5525 and File Reputation enabled. Cisco also published indicators of compromise and recommends checking logs for suspicious activity and renewing credentials on any appliance found to be compromised. _Admins tracking critical patch deadlines for email security appliances can follow these advisories on daily.dev._ ### How many Secure Email Gateway zero-days has Cisco patched recently? CVE-2026-76519 is the third actively exploited zero-day in Cisco Secure Email Gateway within about a year. It follows CVE-2025-20393, a perfect CVSS-10 bug exploited in January, and CVE-2026-76461, exploited in September. Cisco has not disclosed who is behind the attacks across these three incidents. _Security teams evaluating the reliability of Cisco's email gateway line can track this pattern of exploited flaws on daily.dev._ ## Similar posts on daily.dev - [Cisco patches max-severity ISE flaw, the second critical zero-day this week](https://daily.dev/posts/cisco-patches-max-severity-ise-flaw-the-second-critical-zero-day-this-week-sghqhcvbo) · CSO Online · 1 upvotes · 0 comments - [Cisco Unified CM flaw CVE-2026-20230 now exploited in attacks](https://daily.dev/posts/cisco-unified-cm-flaw-cve-2026-20230-now-exploited-in-attacks-ooib1v2zg) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cisco](https://daily.dev/tags/cisco) [View this post on daily.dev](https://daily.dev/posts/cisco-patches-actively-exploited-secure-email-gateway-zero-day-cve-2026-76519-pn2wa0jcf) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Cisco patches actively exploited Secure Email Gateway zero-day CVE-2026-76519","url":"https://daily.dev/posts/cisco-patches-actively-exploited-secure-email-gateway-zero-day-cve-2026-76519-pn2wa0jcf","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cisco-patches-actively-exploited-secure-email-gateway-zero-day-cve-2026-76519-pn2wa0jcf"},"datePublished":"2026-10-14T21:44:56.399Z","dateModified":"2026-10-14T21:45:32.463Z","description":"Cisco has patched CVE-2026-76519, a critical (CVSS 9.8) zero-day in Secure Email Gateway's Advanced Malware Protection feature that was already being exploited...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/818a7a06c78453c2a053a9c7ae6d059d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/818a7a06c78453c2a053a9c7ae6d059d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cisco-patches-actively-exploited-secure-email-gateway-zero-day-cve-2026-76519-pn2wa0jcf","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cisco","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Cisco patches actively exploited Secure Email Gateway zero-day CVE-2026-76519"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cisco-patches-actively-exploited-secure-email-gateway-zero-day-cve-2026-76519-pn2wa0jcf#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-76519 and how is it being exploited?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-76519 is a critical zero-day (CVSS 9.8) in Cisco Secure Email Gateway's Advanced Malware Protection feature, caused by a relative path traversal flaw in attachment handling. An unauthenticated attacker can send a malicious email attachment to write arbitrary files on the appliance and then execute commands as root. Both physical and virtual SEG appliances running AsyncOS with File Reputation enabled are affected, and attackers were already exploiting it before the patch. Teams running Cisco email gateways follow exploited CVE disclosures like this one on daily.dev to patch before attackers strike."}},{"@type":"Question","name":"How do I fix CVE-2026-76519 on Cisco Secure Email Gateway?","acceptedAnswer":{"@type":"Answer","text":"Upgrade to AsyncOS 16.5.0-780 or later, since there is no workaround for this vulnerability. Affected systems are those with Content Scanner Tools versions earlier than 25.3.0.5525 and File Reputation enabled. Cisco also published indicators of compromise and recommends checking logs for suspicious activity and renewing credentials on any appliance found to be compromised. Admins tracking critical patch deadlines for email security appliances can follow these advisories on daily.dev."}},{"@type":"Question","name":"How many Secure Email Gateway zero-days has Cisco patched recently?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-76519 is the third actively exploited zero-day in Cisco Secure Email Gateway within about a year. It follows CVE-2025-20393, a perfect CVSS-10 bug exploited in January, and CVE-2026-76461, exploited in September. Cisco has not disclosed who is behind the attacks across these three incidents. Security teams evaluating the reliability of Cisco's email gateway line can track this pattern of exploited flaws on daily.dev."}}]} ```