Cisco has warned that attackers are actively exploiting a critical zero-day vulnerability in Cisco Secure Email Gateway, which can give them root access to affected appliances. This flaw, tracked as CVE-2026-76519, has a CVSS score of 9.8 and allows attacks through specially crafted email attachments without requiring a login. The company said its security response team became aware of active exploitation in October.

Public reporting has not identified the attackers or established how many devices have been compromised, leaving the scale of the campaign unclear. An attacker can send a malicious attachment through an affected device, allowing it to write arbitrary files and potentially execute commands with root privileges.

The Cisco Secure Email Gateway 0-Day vulnerability affects both physical and virtual appliances when they run vulnerable AsyncOS software and meet specific criteria. These criteria include enabling and assigning a mail policy to the File Reputation feature, and ensuring the Content Scanner Tools package is older than version 25.3.0.5525. Earlier reports highlighted attacks targeting Cisco email appliances, specifically focusing on the Spam Quarantine feature rather than the AMP component.

Administrators should verify the File Reputation setting within the Advanced Malware Protection settings for both incoming and outgoing email policies. For thorough investigation, Cisco advises running grep "System Security" system_logs and conducting a comprehensive scan across all devices in a cluster.