Critical Zero-Day Actively Exploited in Cisco Secure Email Gateway

Affected Environment
Physical and virtual Cisco Secure Email Gateway appliances with AMP File Reputation enabled and Content Scanner Tools older than 25.3.0.5525.

Threat Overview
Critical zero-day CVE-2026-76519 (CVSS 9.8) allows unauthenticated root file writes and command execution. Active exploitation confirmed.

Exposure Timeline
Cisco published its advisory on 14 October 2026; fixed Content Scanner Tools and AsyncOS builds are available now.

Attack Surface
Internet-facing email gateways processing inbound attachments through the Advanced Malware Protection feature.

Technical Root Cause
Relative path traversal (CWE-23) in AMP attachment processing permits arbitrary file writes outside intended directories.

Exploitation Pathway
Attacker emails a crafted attachment through the gateway, triggering file writes and root level command execution without credentials.