CISCO has disclosed that attackers are actively exploiting a critical vulnerability in its Secure Email Gateway (SEG), tracked as CVE-2026-76519 with a CVSS of 9.8/10. The flaw affects the AMP (Advanced Malware Protection) component and arises when processing email attachments if the file reputation service is enabled and Content Scanner Tools is version earlier than 25.3.0.5525.
In October 2026, Cisco’s Product Security Incident Response Team (PSIRT) confirmed in-the-wild exploitation, warning that unauthenticated remote attackers could write arbitrary files to the operating system and run commands with root privileges. Cisco notes that the vulnerability can be triggered by sending crafted attachments, enabling attackers to gain elevated access and potentially erase or hide traces of intrusion.
Cisco has issued indicators of compromise and urged organisations to scan network and firewall logs for signs of suspect activity, such as unusual uploads or downloads to external IPs. For affected physical devices, users are advised to contact Cisco’s Technical Assistance Centre; for virtual appliances, environments should deploy a new VM with a fixed release, rebuild configurations from scratch, and rotate credentials while preserving forensic evidence.
Mitigations were delivered in the patched AsyncOS releases: 15.5.5-014 and 16.5.0-780, released on 14 September 2026, with the advisory later clarifying the in-the-wild exploitation. CVE-2026-76519 follows an earlier exploited vulnerability, CVE-2026-76461, underscoring the urgency for urgent patching, particularly for U.S. agencies listed in CISA’s Known Exploited Vulnerabilities catalogue, which has required patching by 17 October.