Cisco Secure Email Gateway’s Second Zero-Day in a Month Allows Unauthenticated File Write (CVE-2026-76519)

Scope: Cisco Secure Email Gateway and Secure Email and Web Manager, instances with File Reputation enabled and Content Scanner Tools earlier than 25.3.0.5525

Severity: Red

This is the second actively exploited zero-day Cisco has disclosed in its Secure Email Gateway in the span of a month, following CVE-2026-76461 last month. CVE-2026-76519 is a relative path traversal weakness in the gateway’s Advanced Malware Protection feature, triggered by sending a single email with a maliciously crafted attachment, no login required. Cisco actually found and fixed this flaw internally back in September, folding it into a broader hardening release on September 14 without initially flagging it as under attack. The company only became aware this month that threat actors had started exploiting it in the wild, which means the fix has been publicly available for roughly a month while real-world attacks only began recently. Exposure depends on two conditions both being true: File Reputation must be enabled and assigned to a mail policy, and Content Scanner Tools must be on a version earlier than 25.3.0.5525. Organisations running Cisco Secure Email Gateway must confirm their Content Scanner Tools version is current and compare their logs against Cisco’s published indicators of compromise, since the patch has technically been sitting available since September.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.