Cisco warns of actively exploited Secure Email Gateway flaw
Summary
Cisco has issued a warning about a critical vulnerability in its Secure Email Gateway product, tracked as CVE-2026-76519. The flaw allows attackers to write arbitrary files to the underlying operating system and execute commands with root privileges, and is actively being exploited in the wild. Cisco has released software updates to address the issue, but no workarounds are available.
IFF Assessment
This vulnerability allows attackers to gain root access and potentially compromise other cluster members, which is bad news for defenders.
Severity
CISA KEV: Listed as actively exploited. Federal patch due: October 17, 2026. Known ransomware use: Unknown.
Defender Context
Defenders should prioritize patching Cisco Secure Email Gateways immediately due to the active exploitation of this critical vulnerability. The ability for attackers to gain root access and potentially move laterally within a cluster presents a significant risk to email security infrastructure and the data it handles.