Critical Cisco Secure Email Gateway Vulnerability Lets Remote Attackers Run Root Commands
A critical Cisco Secure Email Gateway vulnerability is now being used in real attacks, and any organisation running the appliance should treat it as an urgent maintenance job. The flaw, tracked as CVE-2026-76519 and rated 9.8 out of 10 for severity, lets an outsider with no account and no inside access place files on the device and then run commands with root privileges. Root is the highest permission level on a system, so an attacker who reaches it can effectively take over the appliance. Cisco’s security team says it became aware of active exploitation in October 2026, and CERT-EU drew attention to the issue on 14 October, the same day Cisco published its advisory.
How the Cisco Secure Email Gateway vulnerability works
The problem sits in Advanced Malware Protection, the feature th...