CISA added CVE-2026-76519 to the Known Exploited Vulnerabilities catalog on October 14 with a Federal Civilian Executive Branch remediation deadline of October 17. This is the second zero-day in Cisco Secure Email Gateway exploited in the wild within 30 days.
What the vulnerability does
CVE-2026-76519 is a filter bypass in Cisco Secure Email Gateway's attachment inspection component. A specially crafted email causes the inspection filter to skip analysis of executable payloads. Once delivered to the host, the attacker chains the initial bypass to a local privilege escalation vulnerability, reaching root on the gateway appliance.
Thirty days, two zero-days
CVE-2026-76461, a separate Cisco SEG zero-day, was exploited in the wild in mid-September. Two active zero-days against the same product in 30 days indicates either sustained research focus on Cisco's email security stack or a coordinated campaign that found multiple vulnerabilities in the same code path. Either interpretation should accelerate your patch timeline.
What to do
Patch immediately. The October 17 FCEB deadline reflects CISA's assessment that this is actively exploited, not theoretical risk. For non-FCEB organizations the exploitation risk is identical. Specific actions: apply the Cisco advisory patch or workaround; review inbound email logs for crafted attachments delivered in the past 30 days; consider tightening quarantine rules for executable and archive attachments while patching is in progress; audit the gateway host for indicators of local privilege escalation.
Why email gateways are high-value targets
Email gateways sit at the boundary between the internet and internal networks. A compromised gateway gives attackers a position to intercept, modify, or inject traffic, and a foothold in the network segment the gateway occupies. For organizations routing encrypted internal communication through the gateway for inspection, the exposure is especially serious.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you need help assessing your email gateway exposure.