Cisco Fixes Critical Secure Email Gateway Flaw Used in Attacks to Gain Root Access
Cisco has patched a critical zero-day in Secure Email Gateway that is already being exploited. With a CVSS score of 9.8, the flaw lets an unauthenticated remote attacker place files and run commands with root-level permissions on vulnerable appliances. The issue affects an Advanced component of the product.
Cisco released a fix for CVE-2026-76519, a critical flaw in Secure Email Gateway. The issue sits in the Advanced Malware Protection component and involves how email attachments are handled when File Reputation is active. An attacker can trigger it by sending a crafted attachment through a vulnerable gateway, requiring no login or user action.
Cisco's PSIRT learned of exploitation in October 2026 and disclosed the flaw on October 14. The company has not shared details about the attackers, the number of affected appliances, or what was done after access was obtained. The flaw's severity is reflected in its 9.8 CVSS score.
Organizations that rely on Cisco Secure Email Gateway to filter mail could face heightened risk while patching. A root-level compromise may let intruders read, alter, or block email, potentially exposing sensitive communications and enabling further network access. Employees, customers, and partners whose messages pass through affected appliances could be indirectly affected if data or trust in email systems is undermined. The incident may also prompt security teams to reassess email gateway exposure and patch urgency.