Why two Cisco email gateway exploits in 60 days point to a wider campaign

Cisco has disclosed a critical zero-day in its Secure Email Gateway, tracked as CVE-2026-76519, carrying a CVSS score of 9.8 out of 10. The flaw allows remote, unauthenticated attackers to gain root access through a malicious email attachment. Cisco confirmed active exploitation in the wild. "We are aware of active exploitation of this vulnerability," a Cisco spokesperson said.

CISA added CVE-2026-76519 to its Known Exploited Vulnerabilities catalog the same day and ordered federal civilian agencies to apply fixes by Saturday, October 17, 2026.

This is the second time in two months that a critical SEG flaw has been exploited in the wild. CVE-2026-76461, also CVSS 9.8, was disclosed around September 15, 2026, also under active exploitation, with a CISA patch deadline of September 17. That vulnerability affected both physical and virtual deployments of Cisco AsyncOS for Secure Email Gateway.

The pattern matters more than either incident alone. Two critical SEG zero-days, both confirmed exploited, both drawing short-fuse federal patch orders within a 60-day window, point to sustained targeting of email gateway infrastructure rather than opportunistic scanning. CISA's KEV catalog surpassed 1,739 entries as of October 11, 2026, driven by confirmed exploitation rather than changes in CVSS scores. A 9.8 rating signals severity; evidence of active exploitation is what triggers a binding federal deadline.

CISA's directive binds federal civilian agencies only. Private sector organizations running the same appliances face the same exposure without a mandate.

Patch Cisco Secure Email Gateway immediately. Federal agencies must meet the October 17 deadline; private organizations should treat the same date as their own.

Check for indicators of compromise against Cisco's advisory for CVE-2026-76519 and CVE-2026-76461.