--- title: Cisco patches new Secure Email Gateway zero-day... description: Cisco has patched an actively exploited zero-day flaw, CVE-2026-76519, in its Secure Email Gateway's Advanced Malware Protection feature. The bug is a relative... canonical: https://daily.dev/posts/cisco-patches-new-secure-email-gateway-zero-day-exploited-in-attacks-bdgrg8que twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Cisco patches new Secure Email Gateway zero-day exploited in attacks | daily.dev og:description: Cisco has patched an actively exploited zero-day flaw, CVE-2026-76519, in its Secure Email Gateway's Advanced Malware Protection feature. The bug is a relative... og:url: https://daily.dev/posts/cisco-patches-new-secure-email-gateway-zero-day-exploited-in-attacks-bdgrg8que og:image: https://api.daily.dev/og/posts/BdGrG8QUe.png og:image:alt: Cisco patches new Secure Email Gateway zero-day exploited in attacks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Cisco patches new Secure Email Gateway zero-day exploited in attacks **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary Cisco has patched an actively exploited zero-day flaw, CVE-2026-76519, in its Secure Email Gateway's Advanced Malware Protection feature. The bug is a relative path traversal weakness caused by improper handling of email attachments, letting unauthenticated remote attackers write arbitrary files and execute commands with root privileges. It affects devices with File Reputation enabled and Content Scanner Tools versions earlier than 25.3.0.5525. Cisco shared indicators of compromise, urged admins to check logs for suspicious activity, and recommended renewing credentials on compromised devices. This is the third actively exploited SEG zero-day Cisco has addressed in roughly a year, following CVE-2025-20393 and CVE-2026-76461. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-76519 and how does it affect Cisco Secure Email Gateway? CVE-2026-76519 is a relative path traversal vulnerability in the Advanced Malware Protection feature of Cisco Secure Email Gateway, caused by improper handling of email attachments. It lets unauthenticated remote attackers write arbitrary files and execute commands with root privileges by sending a maliciously crafted attachment. It affects devices with File Reputation enabled and Content Scanner Tools earlier than version 25.3.0.5525, and has been exploited in the wild since October 2026. _Teams patching Cisco Secure Email Gateway can track fast-moving advisories like this one on daily.dev._ ### How do I check if my Cisco Secure Email Gateway is vulnerable to CVE-2026-76519? Run the contentscannerstatus CLI command to check the Content Scanner Tools version; devices earlier than 25.3.0.5525 are vulnerable. Also check whether 'Enable File Reputation' is checked under Mail Policies > Incoming Mail Policies (or Outgoing Mail Policies) > Advanced Malware Protection in the web management interface, since the flaw requires File Reputation to be enabled and assigned to a mail policy. _Admins auditing appliance exposure can follow security advisories like this through daily.dev._ ### How many Cisco Secure Email Gateway zero-days have been exploited in attacks recently? CVE-2026-76519 is the third actively exploited Secure Email Gateway zero-day Cisco has patched in roughly a year, after CVE-2025-20393 (a maximum-severity AsyncOS flaw exploited since November 2025) and CVE-2026-76461 (an email-parsing flaw patched the prior month). Since November 2021, CISA has added 100 Cisco vulnerabilities to its known exploited vulnerabilities catalog, seven of which were used in ransomware attacks. _Security teams tracking repeated Cisco SEG zero-days can follow the pattern via daily.dev._ ## Similar posts on daily.dev - [Cisco patches max-severity ISE flaw, the second critical zero-day this week](https://daily.dev/posts/cisco-patches-max-severity-ise-flaw-the-second-critical-zero-day-this-week-sghqhcvbo) · CSO Online · 1 upvotes · 0 comments - [Cisco warns of unpatched SD-WAN zero-day exploited in attacks](https://daily.dev/posts/cisco-warns-of-unpatched-sd-wan-zero-day-exploited-in-attacks-y5x7rn4ph) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cisco](https://daily.dev/tags/cisco) [View this post on daily.dev](https://daily.dev/posts/cisco-patches-new-secure-email-gateway-zero-day-exploited-in-attacks-bdgrg8que) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Cisco patches new Secure Email Gateway zero-day exploited in attacks","url":"https://daily.dev/posts/cisco-patches-new-secure-email-gateway-zero-day-exploited-in-attacks-bdgrg8que","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cisco-patches-new-secure-email-gateway-zero-day-exploited-in-attacks-bdgrg8que"},"datePublished":"2026-10-14T17:30:44.433Z","dateModified":"2026-10-14T17:51:38.697Z","description":"Cisco has patched an actively exploited zero-day flaw, CVE-2026-76519, in its Secure Email Gateway's Advanced Malware Protection feature. The bug is a relative...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1cbe801ec52174d640b790c5cf840c61?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1cbe801ec52174d640b790c5cf840c61?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cisco-patches-new-secure-email-gateway-zero-day-exploited-in-attacks-bdgrg8que","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cisco","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Cisco patches new Secure Email Gateway zero-day exploited in attacks"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cisco-patches-new-secure-email-gateway-zero-day-exploited-in-attacks-bdgrg8que#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-76519 and how does it affect Cisco Secure Email Gateway?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-76519 is a relative path traversal vulnerability in the Advanced Malware Protection feature of Cisco Secure Email Gateway, caused by improper handling of email attachments. It lets unauthenticated remote attackers write arbitrary files and execute commands with root privileges by sending a maliciously crafted attachment. It affects devices with File Reputation enabled and Content Scanner Tools earlier than version 25.3.0.5525, and has been exploited in the wild since October 2026. Teams patching Cisco Secure Email Gateway can track fast-moving advisories like this one on daily.dev."}},{"@type":"Question","name":"How do I check if my Cisco Secure Email Gateway is vulnerable to CVE-2026-76519?","acceptedAnswer":{"@type":"Answer","text":"Run the contentscannerstatus CLI command to check the Content Scanner Tools version; devices earlier than 25.3.0.5525 are vulnerable. Also check whether 'Enable File Reputation' is checked under Mail Policies > Incoming Mail Policies (or Outgoing Mail Policies) > Advanced Malware Protection in the web management interface, since the flaw requires File Reputation to be enabled and assigned to a mail policy. Admins auditing appliance exposure can follow security advisories like this through daily.dev."}},{"@type":"Question","name":"How many Cisco Secure Email Gateway zero-days have been exploited in attacks recently?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-76519 is the third actively exploited Secure Email Gateway zero-day Cisco has patched in roughly a year, after CVE-2025-20393 (a maximum-severity AsyncOS flaw exploited since November 2025) and CVE-2026-76461 (an email-parsing flaw patched the prior month). Since November 2021, CISA has added 100 Cisco vulnerabilities to its known exploited vulnerabilities catalog, seven of which were used in ransomware attacks. Security teams tracking repeated Cisco SEG zero-days can follow the pattern via daily.dev."}}]} ```