Cisco has released fixes for CVE-2026-76519 in Secure Email Gateway, a flaw that lets an unauthenticated attacker run commands with root privileges. The attack works through a crafted email attachment that passes through a vulnerable appliance. Affected installations have the File Reputation service enabled and an older Content Scanner Tools version. The company says it has known of active exploitation since October 2026 and has published indicators of compromise.

What it means: The flaw is especially serious because it hits the very system meant to filter dangerous email before it reaches staff. Nobody needs to open the attachment, since processing happens automatically on the gateway. An attacker who gains root there can read mail, hide traces and move on to other systems. Many Greek banks, insurers, public bodies and large companies use Cisco products for email security, so the risk is immediate. The first step is to check whether File Reputation is enabled and which Content Scanner Tools version is running, then install the fix at once. Because attackers may erase evidence, Cisco recommends reviewing network and firewall logs for suspicious connections. For organisations covered by NIS2 or DORA, a possible incident on such a system can trigger reporting duties within hours. The case is a reminder that security appliances at the network edge are now a prime target and need the same patching discipline as servers. IT teams that outsource email security to a managed provider should ask that provider in writing whether its appliances were affected and when they were patched.

Read the original on BleepingComputer

Related service: Custom software

Related stories