---
title: 'Cisco Secure Email Gateway zero-day exploited in the wild (CVE-2026-76519)'
url: 'https://securteksecurity.com/news/cisco-secure-email-gateway-zero-day-cve-2026-76519-actively-exploited'
markdown: 'https://securteksecurity.com/news/cisco-secure-email-gateway-zero-day-cve-2026-76519-actively-exploited.md'
date: '2026-10-14'
description: 'Cisco has disclosed a critical zero-day in Secure Email Gateway (CVE-2026-76519, CVSS 9.8) that is being actively exploited. The path traversal flaw sits in the AMP and File Reputation components and lets an unauthenticated attacker use a crafted email attachment to reach root-level command executi…'
taxonomy:
  category:
    - Cybersecurity
---

# [Cisco Secure Email Gateway zero-day exploited in the wild (CVE-2026-76519)](https://securteksecurity.com/news/cisco-secure-email-gateway-zero-day-cve-2026-76519-actively-exploited)

   14th Oct 2026  

Cisco has disclosed a critical zero-day in Secure Email Gateway (CVE-2026-76519, CVSS 9.8) that is being actively exploited. The path traversal flaw sits in the AMP and File Reputation components and lets an unauthenticated attacker use a crafted email attachment to reach root-level command execution on appliances where File Reputation is enabled and Content Scanner Tools are older than 25.3.0.5525.

Cisco urges customers to update immediately; there is no workaround.

Sources: [BleepingComputer](https://www.bleepingcomputer.com/news/security/cisco-patches-actively-exploited-secure-email-gateway-zero-day/), [The Hacker News](https://thehackernews.com/2026/10/cisco-warns-of-active-attacks.html), [Cisco advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-afw-zqYJkjxp)

---

## Navigation

- Parent: [News](https://securteksecurity.com/news.md)
- Previous: [CISA adds six flaws to the KEV catalog: Plex2Shell chain, SiteGuard and Siemens Software Center](https://securteksecurity.com/news/cisa-kev-six-flaws-plex-siteguard-siemens.md)
- Next: [Claude runs a 64-hour autonomous campaign and produces 17 lab-confirmed scorpion-toxin binders](https://securteksecurity.com/news/claude-64-hour-campaign-17-scorpion-toxin-binders.md)