Cisco patches new Secure Email Gateway zero-day exploited in attacks

Cisco has released a fix for another zero-day vulnerability in its Secure Email Gateway (SEG) that was already being exploited by attackers before the patch was available. Tracked as CVE-2026-76519, the bug is a relative path traversal flaw in the Advanced Malware Protection (AMP) attachment-handling feature, which lets an unauthenticated remote attacker send a crafted email attachment to write arbitrary files and run commands with root privileges on the appliance's underlying OS. The flaw only affects devices with File Reputation enabled on a mail policy and running Content Scanner Tools versions older than 25.3.0.5525; Cisco published log-based indicators of compromise and urged admins to check firewall logs for signs of attacker cleanup activity. Cisco says it has already mitigated its own cloud instances and reached out to customers with suspected compromises, recommending credential and certificate renewal, and this marks the latest in a string of actively exploited SEG/AsyncOS zero-days disclosed by Cisco this year, following CVE-2026-76461 and CVE-2025-20393.