Cisco patches second Secure Email Gateway zero-day in as many months, letting one email give attackers root

TLDR

• Cisco patched CVE-2026-76519, a critical Secure Email Gateway flaw exploited as a zero-day to run commands as root.¹²
• Two root-level Secure Email Gateway zero-days in two months suggest attackers are actively mining this product line.¹²
• Cisco has not said who is behind the attacks or how many appliances were compromised.¹²

Cisco's advisory, published on Wednesday, says its product security team "became aware of active exploitation" of the flaw in October 2026.¹ The bug is a relative path traversal weakness caused by improper handling of email attachments, and a Cisco spokesperson told The Register it affects "a limited number of customers."¹² Cisco published log messages that indicate compromise, such as "Suspected compromise indicator was found," and warned customers to check firewall and network logs for unusual uploads and downloads, because attackers may erase evidence once they hold root.¹ Customers Cisco has contacted are advised to restore the device to a secure configuration and renew credentials and cryptographic material, while Cisco advises anyone running AsyncOS releases earlier than 16.5 to migrate to 16.5.0-780.¹²

This is the second Secure Email Gateway zero-day in as many months: in mid-September Cisco warned of CVE-2026-76461, an email-parsing flaw in AsyncOS that also gave unauthenticated attackers root.¹² In January, attackers exploited another critical AsyncOS flaw, CVE-2025-20393, to install persistence mechanisms.¹² The Shadowserver Foundation tracks almost 300 Secure Email Gateway instances exposed online, though it cannot say how many are honeypots or already patched.¹

Why it matters: a mail gateway sits in the path of every inbound message, so a bug triggered by a single attachment turns the device meant to screen for malware into the way in, and two exploited root-level zero-days in two months suggest attackers are actively mining this product line.