Cisco warns critical Secure Email Gateway bug exploited in the wild
Cisco on Oct. 14 warned customers that a critical CVSS 9.8 path traversal vulnerability in its Secure Email Gateway was exploited in the wild.
14, Cisco made the change to CVE-2026-76519 to account for the flaw’s in-the-wild status; 14 warned customers that a critical CVSS 9.8 path traversal vulnerability in its Secure Email Gateway was exploited in the wild.
Soroko said with active exploitation confirmed and CISA adding the vulnerability to its KEV catalog, organizations need to look beyond applying the patch: Cisco has made an updated Content Scanner Tools package available that teams can install without restarting the appliance.
Your evidence has to live somewhere the attacker can’t reach.” Beals added that this represented the second exploited Secure Email Gateway bug in about a month, and he expected attackers to keep working this product until customers change how they run it.
Cisco also warns that compromised SSH keys used between clustered gateways could let attackers reach other appliances: a single compromised gateway could therefore put an organization's entire email infrastructure at risk.
Justin Beals, founder and CEO at Strike Graph, said Cisco deserves credit for publishing indicators of compromise (IoCs) and telling customers plainly that attackers may have scrubbed their tracks.
Assume compromise until you can prove otherwise.” Denis Calderone, chief technology officer at Suzu Labs, added that the consequence for teams of this type of attack are that the attackers can gain complete control of the mail stream: an attacker can read and modify messages in transit, harvest credentials and documents, and operate from a position the organization already trusts, right down to the SSH keys that authenticate cluster members.
14 grouped under a different CVE, so any team that triages patches by individual CVE or waits for a KEV listing could have pushed it down the list for a month.
The networking vendor first rolled out patches for CVE-2026-76519 on Sept, and 14, but the flaw was assigned to CVE-2026-76440 at the time.
The new CVE was also added to the known exploited vulnerabilities (KEV) catalog by the Cybersecurity and Infrastructure Security Agency (CISA) on Oct.
Beals said the hard part for teams was that the fix first shipped Sept.
What happened
14, Cisco made the change to CVE-2026-76519 to account for the flaw’s in-the-wild status; 14 warned customers that a critical CVSS 9.8 path traversal vulnerability in its Secure Email Gateway was exploited in the wild.
What changed
Soroko said with active exploitation confirmed and CISA adding the vulnerability to its KEV catalog, organizations need to look beyond applying the patch: Cisco has made an updated Content Scanner Tools package available that teams can install without restarting the appliance.
Your evidence has to live somewhere the attacker can’t reach.” Beals added that this represented the second exploited Secure Email Gateway bug in about a month, and he expected attackers to keep working this product until customers change how they run it.
Who is affected
Cisco also warns that compromised SSH keys used between clustered gateways could let attackers reach other appliances: a single compromised gateway could therefore put an organization's entire email infrastructure at risk.
Justin Beals, founder and CEO at Strike Graph, said Cisco deserves credit for publishing indicators of compromise (IoCs) and telling customers plainly that attackers may have scrubbed their tracks.
Why it matters
Assume compromise until you can prove otherwise.” Denis Calderone, chief technology officer at Suzu Labs, added that the consequence for teams of this type of attack are that the attackers can gain complete control of the mail stream: an attacker can read and modify messages in transit, harvest credentials and documents, and operate from a position the organization already trusts, right down to the SSH keys that authenticate cluster members.
14 grouped under a different CVE, so any team that triages patches by individual CVE or waits for a KEV listing could have pushed it down the list for a month.
Technical details
The networking vendor first rolled out patches for CVE-2026-76519 on Sept, and 14, but the flaw was assigned to CVE-2026-76440 at the time.
The new CVE was also added to the known exploited vulnerabilities (KEV) catalog by the Cybersecurity and Infrastructure Security Agency (CISA) on Oct.
Response
Beals said the hard part for teams was that the fix first shipped Sept.
The distinction matters because patching prevents further exploitation of the vulnerability, but it does not necessarily remove an attacker who already has control.”
What security teams should do
That access could let attackers intercept messages, interfere with mail delivery, disable security controls, or use the appliance as a foothold for further attacks.
Attribution
SC Media: 14 warned customers that a critical CVSS 9.8 path traversal vulnerability in its Secure Email Gateway was exploited in the wild.
What to watch next
Watch for new exploitation reports and updated indicators of compromise.
Watch for updated vendor guidance and fixed-version details.