Cisco on Oct. 14 warned customers that a critical CVSS 9.8 path traversal vulnerability in its Secure Email Gateway was exploited in the wild.
The networking vendor first rolled out patches for CVE-2026-76519 on Sept. 14, but the flaw was assigned to CVE-2026-76440 at the time.
In its updated advisory on Oct. 14, Cisco made the change to CVE-2026-76519 to account for the flaw’s in-the-wild status. The new CVE was also added to the known exploited vulnerabilities (KEV) catalog by the Cybersecurity and Infrastructure Security Agency (CISA) on Oct. 14.
Justin Beals, founder and CEO at Strike Graph, said Cisco deserves credit for publishing indicators of compromise (IoCs) and telling customers plainly that attackers may have scrubbed their tracks.
Beals said the hard part for teams was that the fix first shipped Sept. 14 grouped under a different CVE, so any team that triages patches by individual CVE or waits for a KEV listing could have pushed it down the list for a month.
“An email gateway touches every attachment that comes into your company,” said Beals. “When an attacker gets root on that box, they own a trusted inspection point and can delete the logs you’d normally use to prove what happened. That’s why Cisco is pointing customers to firewall and network logs outside the device. Your evidence has to live somewhere the attacker can’t reach.”
Beals added that this represented the second exploited Secure Email Gateway bug in about a month, and he expected attackers to keep working this product until customers change how they run it.
“Patch, but don’t close the ticket there,” said Beals. “If you can’t show independent evidence that the device is clean, rebuild it and rotate the credentials. Assume compromise until you can prove otherwise.”
Denis Calderone, chief technology officer at Suzu Labs, added that the consequence for teams of this type of attack are that the attackers can gain complete control of the mail stream: an attacker can read and modify messages in transit, harvest credentials and documents, and operate from a position the organization already trusts, right down to the SSH keys that authenticate cluster members.
“Cisco is blunt about what that means for defenders and notes that attackers with root can remove or hide evidence of exploitation, so they are recommending that the firewall and network logs outside the appliance need to be checked, since the device's own logs can't be trusted,” said Calderone.
Justin Moore, director of adversary operations at Arctic Wolf, said a vulnerability that delivers unauthenticated root access does more than expose another edge device: it could give an attacker a privileged vantage point to observe sensitive communications, interfere with security decisions, conceal activity and establish a foothold inside the enterprise.
Moore said the absence of user interaction stands as especially important: an attacker can target the gateway simply by sending a crafted attachment, bypassing the human safeguards organizations normally associate with email attacks. What’s worse: defenders cannot rely exclusively on the appliance to determine whether it was compromised. They need independent network, firewall, authentication and email telemetry.
“This is also why teams should treat patching as the beginning of the response,” said Moore. “Security teams need to consider the broader trust domain, including clustered appliances, credentials, and cryptographic keys. Where compromise is suspected, preserving evidence, rotating secrets and rebuilding from a known-good state may be the only defensible path back to trust.”
Jason Soroko, senior fellow at Sectigo, said it’s a dangerous case because an attacker can send a specially crafted attachment and potentially gain complete control of the gateway without anyone opening the email. That access could let attackers intercept messages, interfere with mail delivery, disable security controls, or use the appliance as a foothold for further attacks. Cisco also warns that compromised SSH keys used between clustered gateways could let attackers reach other appliances: a single compromised gateway could therefore put an organization's entire email infrastructure at risk.
Soroko said with active exploitation confirmed and CISA adding the vulnerability to its KEV catalog, organizations need to look beyond applying the patch: Cisco has made an updated Content Scanner Tools package available that teams can install without restarting the appliance. However, attackers who obtain root privileges can also erase evidence of their activity.
“Administrators should examine network logs collected outside the gateway and investigate signs of compromise,” said Soroko. “A compromised appliance may need to be rebuilt, with credentials and cryptographic keys replaced. The distinction matters because patching prevents further exploitation of the vulnerability, but it does not necessarily remove an attacker who already has control.”
