Second Cisco Email Gateway Zero-Day in a Month Gives Attackers Root

A single email attachment that no employee ever opens is enough to give attackers root control of an unpatched Cisco Secure Email Gateway. The appliance compromises itself while doing its job: scanning the file for malware.

Cisco disclosed the flaw, tracked as CVE-2026-76519 and rated 9.8 out of 10 on the CVSS scale, in a security advisory on Wednesday, October 14, 2026, and said attackers are already exploiting it. The same day, the Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog, alongside a separately exploited Palo Alto Networks PAN-OS firewall zero-day.

This Cisco Secure Email Gateway zero-day is the second actively exploited flaw in the product in roughly 30 days. For the businesses, hospitals, universities and government agencies that route all of their inbound mail through these appliances, that means another emergency patch cycle on one of the most exposed machines they own.

What the Cisco Secure Email Gateway zero-day does

The bug is a relative path traversal weakness in the gateway's Advanced Malware Protection (AMP) feature, caused by improper handling of email attachments, according to BleepingComputer. CISA's catalog lists it as "Cisco Secure Email Gateway Relative Path Traversal Vulnerability."

An attacker does not need credentials. They only need to send a specially crafted attachment through a vulnerable gateway. Cisco described the result bluntly in its advisory, as quoted by BleepingComputer: "A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system."

There is one important limit. Appliances are exposed only when the File Reputation service is enabled, according to Cyber Security News and other outlets that reviewed the advisory. File Reputation is the part of AMP that checks attachments against Cisco's threat intelligence, which is exactly the feature many security teams turn on to catch malicious files.

Cisco says no workarounds exist. The company's Product Security Incident Response Team wrote, as quoted by ThreatFrontier, that "In October 2026, the Cisco PSIRT became aware of active exploitation of this vulnerability." Cisco has not said who is behind the attacks or how many appliances have been compromised.

Why a scanned email attachment is enough

Most email-borne attacks depend on a person. Someone has to open the invoice, enable the macro or click the link. This one skips the human entirely.

Secure Email Gateway, formerly called Email Security Appliance and running Cisco's AsyncOS, sits between the internet and an organization's mail servers. It inspects every inbound message for spam and malware before anything reaches an inbox. In CVE-2026-76519, the gateway's own malware scan of the attachment is the entry point, Cyber Security News reported. The attacker's file is processed automatically because inspecting files is what the box exists to do.

That position makes email gateways unusually valuable targets. They face the internet by design, they see all incoming mail, and other systems on the network tend to trust them. A compromised gateway could let an intruder read, alter or redirect corporate email, or use the appliance as a foothold to move deeper into the network.

Root access also complicates cleanup. When Cisco disclosed the September flaw, it warned that root-level access could let attackers erase evidence of their activity, according to The Hacker News.

Second exploited Secure Email Gateway flaw in a month

In mid-September, Cisco patched CVE-2026-76461, another CVSS 9.8 flaw in the same product. That bug lived in the email-parsing logic and also allowed an unauthenticated attacker to run commands as root. "Upon successful exploitation of this vulnerability, threat actors may obtain command execution with root privileges," Cisco said at the time, as quoted by The Hacker News.

The September bug affected the gateway regardless of configuration and had no workaround, Security Today reported. Cisco contacted Secure Email Cloud customers whose devices showed malicious activity but did not disclose how widespread the attacks were.

Zoom out further and a pattern emerges. In July 2024, Cisco fixed CVE-2024-20401, a gateway flaw that let attackers add root users or crash appliances using malicious attachments. That makes CVE-2026-76519 the third serious attachment- or parsing-related flaw in this product in a little over two years, and the second in a month.

Nobody has said whether the same group is behind both 2026 campaigns. But attackers who find one parsing bug in an appliance often go looking for its neighbors, and the code that unpacks and inspects untrusted files is a natural place to dig.

CISA KEV adds Cisco and Palo Alto PAN-OS zero-days

CISA's October 14 update added four vulnerabilities to the KEV catalog: the Cisco flaw, Palo Alto Networks PAN-OS bug CVE-2026-0322, and two flaws in Ahsay's AhsayCBS backup software, CVE-2026-105133 and CVE-2026-105134.

The agency pointed to Binding Operational Directive 26-04, which requires federal civilian executive branch agencies to prioritize KEV flaws on internet-facing systems that give attackers total control, and sets expectations for when agencies must check for compromise before patching. CISA urged all organizations, not only federal ones, to treat KEV entries as priorities. The remediation deadline for the Cisco flaw was not included in the reporting USA 24 reviewed.

The PAN-OS deadline is firm: federal agencies must fix CVE-2026-0322 by October 17, according to SecurityWeek. The flaw affects PA-Series and VM-Series firewalls and Panorama, was discovered internally and requires no special configuration to exploit. "Very limited exploitation has been observed targeting the Palo Alto Networks management interface," the company said in its advisory, as quoted by SecurityWeek. Palo Alto published a handful of IP addresses as indicators of compromise. The KEV catalog now lists 16 Palo Alto Networks vulnerabilities, three of them added this year.

Two network-security vendors that many US enterprises and agencies depend on disclosing exploited zero-days on the same day fits the year's broader trend. Attackers keep aiming at edge devices: firewalls, VPNs and mail gateways that sit on the perimeter and rarely run endpoint security tools. USA 24 recently reported on an Ivanti Connect Secure zero-day that was exploited for 12 days before a patch, and on a Windows flaw Microsoft patched as a CISA deadline approached.

CVE-2026-76519 patch: which versions are affected

Cisco's fix can be applied by updating the Content Scanner Tools package or by upgrading AsyncOS, SecurityOnline reported. Content Scanner Tools versions earlier than 25.3.0.5525 are vulnerable when File Reputation is enabled, according to OffSeq Threat Radar.

The AsyncOS picture is murkier. OffSeq lists AsyncOS 15.5.5-014 and 16.5.0-780 as fixed releases, but those are the same build numbers Cisco gave for the September CVE-2026-76461 fix, which may reflect confusion between the two bugs. ThreatFrontier reports there is no fixed 16.0 build. USA 24 could not independently verify the version matrix, so administrators should treat Cisco's advisory as the only authority on affected and fixed releases.

What security teams should do now

If your organization runs Cisco Secure Email Gateway on-premises or as a virtual appliance, work through these steps today:

• Inventory every gateway. Include virtual appliances and lab or backup units that still receive mail, and check whether AMP File Reputation is enabled on each.
• Patch. Update Content Scanner Tools to 25.3.0.5525 or later, or upgrade AsyncOS to a release Cisco lists as fixed. Confirm version numbers against Cisco's advisory before you schedule the work.
• Don't wait for a mitigation. Cisco says there are no workarounds. Disabling File Reputation would remove the vulnerable condition but also strip a malware defense, so weigh that tradeoff only as a short bridge to patching.
• Hunt for compromise. Follow Cisco's indicators and guidance. OffSeq reports that Cisco's recommendations include rebuilding virtual appliances and rotating credentials if compromise is suspected. Given that root access can erase traces, a clean scan is not proof of a clean box.
• Close the September gap. If you skipped the CVE-2026-76461 patch, apply it as well. Security Today lists AsyncOS 15.5.5-014, 16.0.4-302 and 16.5.0-780 as fixed for that bug.
• Handle Palo Alto separately. If you run PAN-OS firewalls or Panorama, restrict management-interface access to trusted internal addresses, patch CVE-2026-0322 and check logs for the IP indicators Palo Alto published.

Consumers don't need to do anything directly. The risk to them is indirect: a breached gateway at an employer, hospital or service provider could expose personal data that passes through corporate email.

What we still don't know about the attacks

Cisco hasn't named the attackers, said how many organizations were hit, or explained how it learned of the exploitation. One outlet, Cyber Press, reported that Cisco found the bug through internal security scanning, but that claim has not been confirmed elsewhere. It is also unclear whether Cisco-hosted Secure Email Cloud customers were affected or patched proactively, as some were contacted in September.

The next signals to watch are a CISA remediation deadline for the Cisco flaw, any threat-intelligence reporting that ties the October and September campaigns to the same group, and whether Cisco publishes indicators of compromise detailed enough for defenders to check their own logs. With two root-level gateway zero-days in a month, organizations that have treated their email appliance as a set-and-forget box will need to start auditing it as closely as their firewalls and VPNs.