Cisco Secure Email Gateway zero-day exploited in the wild (CVE-2026-76519)

Cisco has disclosed a critical zero-day in Secure Email Gateway (CVE-2026-76519, CVSS 9.8) that is being actively exploited. The path traversal flaw sits in the AMP and File Reputation components and lets an unauthenticated attacker use a crafted email attachment to reach root-level command execution on appliances where File Reputation is enabled and Content Scanner Tools are older than 25.3.0.5525.

Cisco urges customers to update immediately; there is no workaround.

Sources: BleepingComputer, The Hacker News, Cisco advisory