The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical vulnerability in Cisco’s Secure Email Gateway (SEG), tracked as CVE-2026-76519, to its Known Exploited Vulnerabilities (KEV) catalog based on evidence of active exploitation. The action requires U.S. federal civilian agencies to address the flaw by October 17, 2026.
Cisco released a patch for the zero-day vulnerability on October 14, 2026, and disclosed that attackers were actively exploiting it. The flaw is a relative path traversal weakness in the gateway’s Advanced Malware Protection (AMP) feature. An unauthenticated remote attacker could exploit it by sending an email with a specially crafted attachment, potentially writing arbitrary files and executing commands with root privileges on the underlying operating system.