CyberNew CyberNew
Cyber News BleepingComputer 2 days ago

Cisco patches new Secure Email Gateway zero-day exploited in attacks

CN
CyberNew Threat Research Desk
• Original Reporting: BleepingComputer
CyberNew Threat Intel Assessment
Assessed Severity: CRITICAL
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Cyber News

Analyst Takeaway

"Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges. Tracked as CVE-2026-76519, this vulnerability stems from a relative path traversal weakness in SEG's Advanced Malware Protection (AMP) feature, caused by improper handling of email attachments. Threat actors can exploit this..."

Recommended Defense & Mitigation

  • Emergency Patching: Prioritize vendor patches and CVE mitigation across internet-facing assets immediately.
  • Perimeter Audit: Inspect perimeter firewall logs and hunt for unauthorized RCE indicators.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)

Cisco

Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges.

Tracked as CVE-2026-76519, this vulnerability stems from a relative path traversal weakness in SEG's Advanced Malware Protection (AMP) feature, caused by improper handling of email attachments. Threat actors can exploit this issue by sending an email with a maliciously crafted attachment through an unpatched device.

"A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system," Cisco said in a Wednesday advisory. "In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability."

Log Message Recommended Action
System Security: Suspected compromise indicator was found. Contact TAC for further recommendations. Compromise detected. Follow the instructions in the Recommendations section of this Security Advisory
System Security: Security scan did not complete. Contact TAC for further recommendations. Contact the Cisco Technical Assistance Center (TAC) for further support.
System Security: No compromise indicator was found. No compromise detected. Upgrade to a fixed software release if applicable
Save your seat

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from BleepingComputer.

Primary Advisory →