Critical Zero-Day Actively Exploited in Cisco Secure Email Gateway

THREAT INTELLIGENCE

Peer Review

4.8

Proven Trust

Dark blue circle with two overlapping checkmarks, one green and one light blue.

ISO 27001 text with a globe outline symbol on a black background.

2025 winner badge for Cyber Security Excellence Awards with gold and black design.

High

CVE-2026-76519

Cisco

October 15, 2026

Executive Summary

Critical zero-day CVE-2026-76519 (CVSS 9.8) allows unauthenticated root file writes and command execution. Active exploitation confirmed.

Key Details

Affected Platform

Cisco Secure Email

Attack Surface

Recommended Action

Apply vendor patch

Affected Environment

Physical and virtual Cisco Secure Email Gateway appliances with AMP File Reputation enabled and Content Scanner Tools older than 25.3.0.5525.

Operational Impact

Attackers can alter security settings, interfere with mail processing, or establish persistent access on the gateway.

Technical Root Cause

Relative path traversal (CWE-23) in AMP attachment processing permits arbitrary file writes outside intended directories.

Recommended Mitigation

Update Content Scanner Tools to 25.3.0.5525 or later; migrate to AsyncOS 16.5.0-780 or the applicable fixed release.

Concerned about your exposure?

Our security experts can help you assess affected systems, validate risk and support a safe remediation plan.

Discuss Your Security Exposure Explore Managed Detection and Response

Assess your risk

Identify affected systems

Plan remediation

Practical, vendor-aligned guidance

Get expert support

From our 24/7 security team

Stay ahead of emerging threats

Get the latest threat intelligence and security advisories from Smarttech247.

Full Technical Report

Download the complete analysis, including detailed technical findings and references.

Download Full Report (PDF)

References

Cisco Security Advisories.