Cisco Secure Email Gateway zero-day: fixed releases and IoCs

CVE-2026-76519 in Cisco Secure Email Gateway (SEG), exploited as a zero-day, lets an unauthenticated attacker write files and run commands as root by sending an email with a crafted attachment. The mechanism, the severity (CVSS 9.8) and CISA’s addition to the KEV catalog are covered in our 14 October article. Since then, Cisco’s advisory, as reported by BleepingComputer and The Register, and advisory AV26-1042 from the Canadian Centre for Cyber Security have added the details gateway administrators need: the exact vulnerable conditions, the fixed releases, the log messages that point to a compromise and the checks to run after updating.

When a gateway is vulnerable

According to Cisco’s advisory, as reported by both outlets, the flaw affects SEG appliances, physical and virtual, running a vulnerable Cisco AsyncOS release when both of these conditions are met:

• the File Reputation service, part of Advanced Malware Protection (AMP), is enabled and assigned to a mail policy;
• the Content Scanner Tools version is earlier than 25.3.0.5525.

BleepingComputer reports two checks:

• from the command line, contentscannerstatus shows the Content Scanner Tools version in use;
• in the web interface, the “Enable File Reputation” checkbox is under Mail Policies > Incoming Mail Policies > Advanced Malware Protection and the equivalent path in Outgoing Mail Policies. Check both: the condition applies to outbound mail too.

Fixed releases

The Canadian Centre’s advisory AV26-1042 lists the reference releases:

• Cisco AsyncOS for Secure Email Gateway: 15.5 releases before 15.5.5-014; 16.5 releases before 16.5.0-780;
• Cisco Secure Email and Web Manager: 15.5 releases before 15.5.5-006; 16.5 releases before 16.5.0-429.

The Canadian advisory refers to vulnerabilities in the plural and also links to the September 2026 “Security Hardening Release” for SEG and Secure Email and Web Manager. The two outlets, by contrast, describe CVE-2026-76519 for SEG only: for Secure Email and Web Manager, check Cisco’s advisory to see which fix the listed releases refer to.

According to The Register, there are no workarounds: only an AsyncOS upgrade closes the hole. Cisco recommends that customers on releases earlier than 16.5 migrate to 16.5.0-780.

Indicators of compromise

Cisco has not described the attacks, but according to BleepingComputer it has published the log messages the gateway shows after a security check, with the action to take:

• System Security: Suspected compromise indicator was found. Contact TAC for further recommendations.: compromise detected, follow the recommendations in the advisory;
• System Security: Security scan did not complete. Contact TAC for further recommendations.: check not completed, contact the Cisco Technical Assistance Center (TAC);
• System Security: No compromise indicator was found.: no compromise detected, install the fixed release if applicable.

Cisco also warns that an attacker with root command execution may remove evidence of exploitation from the appliance. It therefore asks customers to cross-check firewall and network logs for suspicious activity, such as downloads and uploads to and from external or suspicious IP addresses. In MITRE ATT&CK terms, besides initial exploitation (T1190, Exploit Public-Facing Application), removing evidence would fall under T1070 (Indicator Removal): the sources present it as a possibility, not as observed behaviour.

Cloud instances and contacted customers

According to BleepingComputer, Cisco has already deployed mitigations on cloud instances and has contacted Cisco Secure Email Cloud customers where it found evidence of a potential compromise. It recommends that they restore the device to a secure configuration by renewing credentials and cryptographic material installed on the appliance, and restrict access to the gateway with robust access controls.

A Cisco spokesperson told The Register that the vulnerability affects “a limited number of customers”, but would not say how many appliances were compromised or what the attackers did once inside. Cisco became aware of active exploitation in October 2026.

Exposure and context

BleepingComputer cites Shadowserver data: nearly 300 Cisco Secure Email Gateway instances exposed online, with no indication of how many are honeypots or already patched.

This is the second SEG zero-day in two months: in mid-September Cisco reported exploitation of CVE-2026-76461, in AsyncOS email parsing, which also leads to root command execution. Earlier, AsyncOS CVE-2025-20393 was exploited against SEG and Secure Email and Web Manager appliances: since November 2025 according to BleepingComputer, with a fix in January; according to The Register, attackers used it to install persistence mechanisms.

For European and Italian companies the repetition matters: the mail gateway is exposed by design and has repeatedly been the entry point. For NIS2 entities it is a system to treat as critical in vulnerability management, with documented compromise checks after every update.

What to do now

1. Check both conditions on every gateway: contentscannerstatus for Content Scanner Tools and the “Enable File Reputation” checkbox in incoming and outgoing policies.
2. Upgrade AsyncOS to 15.5.5-014 or 16.5.0-780 (from releases earlier than 16.5, to 16.5.0-780). There are no workarounds.
3. Check the System Security messages and contact TAC if they report a suspected compromise or an incomplete scan.
4. Cross-check firewall and network logs, which the attacker cannot wipe from the gateway: transfers to and from external or suspicious IPs.
5. If there is a compromise or Cisco has contacted you: renew the credentials, keys and certificates installed on the appliance and restrict access to management.
6. For Secure Email and Web Manager, check Cisco’s advisory for the releases to install.

How ARXDOME helps

ARX Sentry collects firewall logs in a central collector, outside the gateway: connections to and from the appliance remain available even if local traces are wiped. ARX Horizon enriches IP addresses with threat lists, and ARX Expose flags mail services exposed on the Internet and their known vulnerabilities.

Last updated: 15 October 2026