Security Advisory: CVE-2026-76519 - Critical Cisco Secure Email Gateway Remote Code Execution Vulnerability

Advisory ID: SA-2026-1015

Severity: Critical (CVSS 9.8)

CVE: CVE-2026-76519

Affected Product: Cisco Secure Email Gateway (SEG)

Date: October 15, 2026

Status: Actively Exploited in the Wild

---

Executive Summary

A critical vulnerability, CVE-2026-76519, has been identified in Cisco Secure Email Gateway that allows an unauthenticated remote attacker to execute arbitrary commands with root privileges on affected appliances. The vulnerability is being actively exploited and has been added to the CISA Known Exploited Vulnerabilities (KEV) Catalog.

Successful exploitation requires only that an attacker send a specially crafted email containing a malicious attachment through a vulnerable gateway. No valid credentials or user interaction are required.

Organizations utilizing Cisco Secure Email Gateway should prioritize immediate remediation and threat hunting activities.

---

Vulnerability Details

CVE: CVE-2026-76519

CVSS Score: 9.8 (Critical)

Attack Vector: Network

Authentication Required: No

User Interaction Required: No

Impact: Remote Code Execution / Privilege Escalation to Root

The vulnerability exists within the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. Improper handling of email attachments when the File Reputation service is enabled can allow attackers to exploit a relative path traversal weakness.

An attacker can exploit the flaw by sending an email containing a specially crafted attachment through a vulnerable gateway. Successful exploitation may allow the attacker to:

• Write arbitrary files to the underlying operating system.
• Execute arbitrary commands as root.
• Fully compromise the email security appliance.
• Establish persistence and potentially pivot into internal network environments.

---

Affected Systems

According to Cisco, both physical and virtual SEG appliances may be vulnerable if the following conditions exist:

1. The File Reputation service (part of AMP) is enabled and assigned to a mail policy.
2. The installed Content Scanner Tools version is earlier than 25.3.0.5525.

---

Active Exploitation

Cisco Product Security Incident Response Team (PSIRT) has confirmed awareness of active exploitation occurring in October 2026. The vulnerability has also been added to the CISA KEV Catalog, requiring federal agencies to address the issue on an accelerated timeline.

The vulnerability is particularly dangerous because exploitation:

• Can be performed remotely.
• Requires no authentication.
• Requires no end-user interaction.
• Results in root-level system access.

---

Indicators of Possible Compromise

Administrators should investigate SEG appliances for the following security alerts identified by Cisco:

• "System Security: Suspected compromise indicator was found. Contact TAC for further recommendations."
• "System Security: Security scan did not complete. Contact TAC for further recommendations."

Additional signs of compromise may include:

• Unexpected system processes.
• Unauthorized files or scripts.
• Changes to mail flow configurations.
• Unexpected outbound network traffic.
• Creation of unknown administrative accounts.

---

Mitigation and Remediation

Immediate Actions

1. Identify all deployed Cisco Secure Email Gateway appliances.
2. Verify whether AMP File Reputation is enabled.
3. Determine the installed Content Scanner Tools version using:

contentscannerstatus

Apply Vendor Updates

Upgrade to a fixed release provided by Cisco. Cisco has stated that no workaround exists for this vulnerability and recommends upgrading affected systems immediately.

If Compromise is Suspected

• Isolate affected SEG appliances from the network.
• Preserve logs and forensic evidence.
• Review mail processing activity for malicious attachments.
• Reset administrative credentials.
• Contact Cisco Technical Assistance Center (TAC) for incident response guidance.

---

Risk Assessment

Category	Assessment
Severity	Critical
Exploitation Status	Active
Authentication Required	No
User Interaction	None
Privilege Gained	Root
Business Impact	High
Recommended Priority	Immediate

The combination of unauthenticated exploitation, remote attack capability, root-level access, and confirmed in-the-wild exploitation makes CVE-2026-76519 one of the highest-priority vulnerabilities affecting email security infrastructure in 2026.