Cisco Patches Zero Day Flaw in Secure Email Gateway

Cisco has released security patches to address a critical zero-day vulnerability in its Secure Email Gateway appliance that is being actively exploited in attacks, according to reports from The Hacker News and BleepingComputer. The flaw allows remote attackers with no login credentials to execute commands with root privileges on the targeted device. [1][2]

The vulnerability is tracked as CVE-2026-76519, BleepingComputer reported. The flaw stems from a relative path traversal weakness within the Advanced Malware Protection feature of the gateway, which is caused by improper handling of email attachments. The Hacker News and BleepingComputer both report that hackers can exploit this vulnerability by sending an email containing a specially crafted attachment through the appliance. [1][2]

A zero-day vulnerability is a security flaw in software that is unknown to the developers or lacks a fix at the time of discovery. As FTMQ Security reported earlier, Cisco also recently addressed an actively exploited authentication bypass vulnerability, tracked as CVE-2026-76504, in its Catalyst SD-WAN Manager. [8][11]

Cisco confirmed in an advisory issued on Wednesday that the flaw allows attackers to write files to the underlying operating system of the appliance, according to The Hacker News. Security administrators are advised to apply the official software patches immediately to safeguard affected systems against remote command execution. [1]