Cisco Secure Email Gateway 0-Day Vulnerability Actively Exploited in Attacks

Cisco has warned that attackers are actively exploiting a critical zero-day vulnerability in Cisco Secure Email Gateway that can give them root access to affected appliances. Tracked as CVE-2026-76519, the flaw carries a CVSS score of 9.8 and allows attacks through specially crafted email attachments without requiring a login.

Cisco published its advisory on October 14, 2026. The company said its security response team became aware of active exploitation in October. Public reporting has not identified the attackers or established how many devices have been compromised, leaving the scale of the campaign unclear.

The vulnerability sits in the Advanced Malware Protection feature, known as AMP. Cisco says the gateway fails to handle certain email attachments safely when its File Reputation service is enabled. An attacker can send a malicious attachment through an affected device to write arbitrary files and potentially execute commands with root privileges.

Root access gives…