Cisco SEG zero-day CVE-2026-76519 exploited for root command execution

Affected Systems

Cisco Secure Email Gateway (SEG) appliances with File Reputation service enabled and Content Scanner Tools version earlier than 25.3.0.5525. Approximately 300 instances exposed online. Cloud instances already mitigated by Cisco.

Exploitation Status

Actively exploited in the wild since October 2026. Cisco PSIRT confirmed active exploitation. Attackers send emails with malicious attachments to trigger path traversal in AMP feature. IOCs provided by Cisco.

Business Impact

Remote unauthenticated attackers gain root-level command execution and arbitrary file write on vulnerable SEG appliances. Attackers can remove exploitation evidence after compromise. Email security perimeter is fully bypassed. This is the fourth actively exploited SEG zero-day in 18 months, indicating sustained targeting of this product line. Organizations using on-premises SEG face immediate risk of full appliance compromise and potential lateral movement.

Urgency

🔴 Immediate

Recommended Actions

• Immediately verify Content Scanner Tools version using 'contentscannerstatus' CLI command on all SEG appliances
• Upgrade Content Scanner Tools to version 25.3.0.5525 or later on all vulnerable SEG instances
• Search SEG logs for 'System Security: Suspected compromise indicator was found' or 'Security scan did not complete' messages and contact Cisco TAC if found
• Review firewall and network logs for suspicious downloads/uploads to external IPs from SEG appliances, especially if root access was gained
• If compromise is suspected, renew all credentials and cryptographic materials on the appliance and restrict access with robust access controls