Cisco Warns of Hackers Exploiting a Critical Security Flaw in Email Systems
Cisco has warned that hackers are actively taking advantage of a serious security weakness in its Secure Email Gateway product, which businesses use to protect their email systems from harmful messages and cyber threats. The vulnerability could allow attackers to break into affected systems without needing a password or permission. If successful, hackers could gain extensive control over the device, potentially putting an organization’s email security and other connected systems at risk.
The security flaw, identified as CVE-2026-76519, has been given a severity rating of 9.8 out of 10, making it a critical security concern. Attackers may be able to exploit the issue by sending an email with a specially designed attachment through a vulnerable system. If the attack succeeds, they could potentially add harmful files, run unauthorized commands, and take control of the affected device. This is especially concerning because the attack does not require the hacker to log in first.
However, not every Cisco Secure Email Gateway system is automatically vulnerable. The risk depends on the software version being used and whether certain security features are enabled. Both physical devices and virtual versions of the product may be affected. Cisco has not reported that its other products, including Secure Email and Web Manager and Secure Web Appliance, are impacted by this particular vulnerability.
Cisco confirmed that it became aware of attacks exploiting the flaw in October 2026. The company has not publicly explained who is behind the attacks, how many organizations may have been affected, or whether attackers have successfully taken control of vulnerable systems. Cisco has contacted certain customers using its managed cloud email security service after identifying possible signs of compromise and has begun taking steps to address the issue.
To protect their systems, organizations need to install the updated security software provided by Cisco. The company has released a fix that can be installed without requiring a complete operating system upgrade or restarting the device. Administrators should check which version is installed and make sure they are using the corrected version or a newer release. Cisco has also provided updated software for affected systems, and some older versions may need to be upgraded to a supported release. There is currently no alternative workaround that fully resolves the problem, making it important for affected organizations to apply the available fixes.
Businesses should also check whether hackers may have already accessed their systems. Cisco recommends reviewing system records for warning signs that could indicate suspicious activity. Security teams should also look for unusual data transfers, such as unexpected files being sent to or downloaded from unfamiliar internet addresses. However, finding no warning signs does not guarantee that a system is safe, because skilled attackers may be able to hide evidence of their activity.
If an organization believes its system has been compromised, simply installing an update may not be enough. Cisco recommends contacting its technical support team for help investigating affected physical devices. For virtual systems, organizations may need to create a new, secure system, restore it carefully, change passwords and other security credentials, and check related devices for signs of unauthorized access. Businesses using several connected email security devices should also investigate the other devices, as an attack on one system could put others at risk.
This warning follows another security issue affecting Cisco Secure Email Gateway that was reported in September 2026. That earlier vulnerability also allowed attackers to potentially gain control of affected systems without logging in. However, Cisco has not confirmed whether the two vulnerabilities are connected or whether the same attackers are responsible.
The latest incident is a reminder that even security products designed to protect businesses can have weaknesses that hackers may exploit. Organizations using Cisco Secure Email Gateway should check whether their systems are affected, install the recommended updates, and investigate any unusual activity. Taking these steps quickly can help reduce the risk of unauthorized access and prevent a security problem from becoming a larger incident.
