/
← Voltar ao feed
critical

Cisco Secure Email Gateway zero-day CVE-2026-76519 allows unauthenticated root RCE via malicious email, exploited in the wild

2 fonte(s) · 1 atualização(ões) · 1 repetição(ões) · publicado 14/10/2026 18:40 · coletado há 2 dias

Cisco disclosed that CVE-2026-76519, a critical (CVSS 9.8) flaw in Secure Email Gateway (SEG), has been exploited as a zero-day before a fix was available. A remote, unauthenticated attacker can write files and execute commands as root on the appliance simply by sending a malicious email. CISA added the flaw to its Known Exploited Vulnerabilities catalog and set a Saturday deadline for US federal agencies. Cisco says the issue affects "a limited number of customers" but declined to say how many appliances were compromised or what attackers did after exploitation. This is the second SEG zero-day in about a month, following CVE-2026-76461 in mid-September, and follows the earlier exploitation of CVE-2025-20393 in January. Attribution is unknown ("unknown crims").

Detalhes técnicos

  • The flaw is in the Advanced Malware Protection (AMP) feature of SEG and stems from improper handling of email attachments.
  • A malicious attachment lets the attacker write files and run commands as root on the underlying operating system.
  • Both physical and virtual SEG appliances running a vulnerable Cisco AsyncOS Software release are affected, provided both conditions are met: the File Reputation service (part of Cisco AMP) is enabled and assigned to a mail policy, and the Content Scanner Tools version is earlier than 25.3.0.5525.
  • Cisco became aware of active exploitation in October.
  • The earlier SEG bug CVE-2025-20393 was used in January to install persistence mechanisms and was eventually scored CVSS 10.

Remediação

  • Upgrade to a fixed Cisco AsyncOS Software release. There are no workarounds.
  • Customers running AsyncOS releases earlier than 16.5 should migrate to 16.5.0-780.
  • Use the steps in Cisco's Wednesday advisory to check whether File Reputation is enabled and which Content Scanner Tools version is installed.
  • Follow the hardening guidance in the Cisco advisory.
  • US federal agencies must remediate by the CISA KEV deadline (Saturday).

Linha do tempo

  1. theregister.com ↗ · pub. 14/10/2026 18:40 · coletado 19/10 17:54 primeiro registro

    Cisco Secure Email Gateway zero-day CVE-2026-76519 allows unauthenticated root RCE via malicious email, exploited in the wild

    ler a análise desta fonte

    Cisco disclosed that CVE-2026-76519, a critical (CVSS 9.8) flaw in Secure Email Gateway (SEG), has been exploited as a zero-day before a fix was available. A remote, unauthenticated attacker can write files and execute commands as root on the appliance simply by sending a malicious email. CISA added the flaw to its Known Exploited Vulnerabilities catalog and set a Saturday deadline for US federal agencies. Cisco says the issue affects "a limited number of customers" but declined to say how many appliances were compromised or what attackers did after exploitation. This is the second SEG zero-day in about a month, following CVE-2026-76461 in mid-September, and follows the earlier exploitation of CVE-2025-20393 in January. Attribution is unknown ("unknown crims").

    Technical Details

    • The flaw is in the Advanced Malware Protection (AMP) feature of SEG and stems from improper handling of email attachments.
    • A malicious attachment lets the attacker write files and run commands as root on the underlying operating system.
    • Both physical and virtual SEG appliances running a vulnerable Cisco AsyncOS Software release are affected, provided both conditions are met: the File Reputation service (part of Cisco AMP) is enabled and assigned to a mail policy, and the Content Scanner Tools version is earlier than 25.3.0.5525.
    • Cisco became aware of active exploitation in October.
    • The earlier SEG bug CVE-2025-20393 was used in January to install persistence mechanisms and was eventually scored CVSS 10.

    Remediation

    • Upgrade to a fixed Cisco AsyncOS Software release. There are no workarounds.
    • Customers running AsyncOS releases earlier than 16.5 should migrate to 16.5.0-780.
    • Use the steps in Cisco's Wednesday advisory to check whether File Reputation is enabled and which Content Scanner Tools version is installed.
    • Follow the hardening guidance in the Cisco advisory.
    • US federal agencies must remediate by the CISA KEV deadline (Saturday).

Repetiram sem novidade