🚨Cisco SEG Vulnerability Allows Root Access via Email Attachments
Critical Cisco SEG Bug Exploited Before Fix
TL;DR
A critical vulnerability in Cisco's Secure Email Gateway (SEG) allows attackers to gain root access via email attachments. The bug, tracked as CVE-2026-76519, was exploited before Cisco issued a fix. Federal agencies have a Saturday deadline to patch.
Cisco's Secure Email Gateway (SEG) is facing a critical vulnerability that allows attackers to gain root access by sending malicious email attachments. The bug, tracked as CVE-2026-76519, received a CVSS score of 9.8 and was exploited in zero-day attacks before a fix was issued. This vulnerability affects a limited number of customers and impacts both physical and virtual SEG appliances running AsyncOS Software versions earlier than 16.5.0-780. The flaw exists in the Advanced Malware Protection (AMP) feature and requires the File Reputation service to be enabled and assigned to a mail policy. Upgrading to a fixed Cisco AsyncOS Software release is the only solution. This is the second such zero-day in SEG in as many months.
Key Points
CVE-2026-76519 allows attackers to write files and execute commands with root privileges on SEG appliances.
The vulnerability affects both physical and virtual SEG appliances running AsyncOS Software earlier than v16.5.0-780.
File Reputation service must be enabled and assigned to a mail policy for the vulnerability to be exploitable.
Cisco recommends upgrading to AsyncOS Software v16.5.0-780 to patch the security hole.
US CISA added the vulnerability to its Known Exploited Vulnerabilities catalog.
Why It Matters
If you're running Cisco SEG with AsyncOS Software earlier than v16.5.0-780, you're at risk. The vulnerability allows attackers to gain root access via email attachments, potentially leading to data breaches and system compromises. Upgrading to the latest version is crucial to mitigate this risk.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.