Cisco patches exploited email gateway flaw allowing root access

Cisco has patched an actively exploited Secure Email Gateway vulnerability that allows unauthenticated attackers to execute commands with root privileges. Its Wednesday advisory says CVE-2026-76519 arises from improper handling of email attachments in the Advanced Malware Protection feature. The flaw affects devices with File Reputation enabled and assigned to a mail policy when Content Scanner Tools is earlier than version 25.3.0.5525. A crafted attachment can let attackers write arbitrary files and execute commands. Cisco says it has deployed cloud mitigations and contacted cloud device owners where it found potential compromise. It urges administrators to examine firewall and network logs because attackers may erase evidence after gaining root access.