Cisco patches Secure Email Gateway zero-day exploited in attacks

Cisco patched an actively exploited zero-day (CVE-2026-76519) in Secure Email Gateway that lets unauthenticated remote attackers execute commands with root privileges via a malicious email attachment. The flaw affects SEG instances with File Reputation enabled and Content Scanner Tools older than 25.3.0.5525.

• CVE-2026-76519 is a path traversal in AMP enabling root command execution
• Affected: SEG with File Reputation and Content Scanner Tools below 25.3.0.5525
• Cisco applied mitigations on cloud instances and notified affected customers
• Shadowserver tracks nearly 300 Cisco SEG instances exposed online