[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6naga6su6l2V3idbiMjeizNLJf1TvO7JSsXSobxe1q8":3},{"article":4,"iocs":46,"watch_terms":57,"solutions":58,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"71447e2c-044f-4fb8-ac7e-891bffebd334","Cisco Warns of Exploited Secure Email Gateway Vulnerability","cisco-warns-of-exploited-secure-email-gateway-vulnerability-c52508","Unauthenticated, remote attackers could write arbitrary files to the operating system and execute commands with root privileges. The post Cisco Warns of Exploited Secure Email Gateway Vulnerability appeared first on SecurityWeek.","Cisco has issued a warning about a critical vulnerability (CVE-2026-76519) in its Secure Email Gateway, specifically impacting the Advanced Malware Protection feature. Attackers can exploit this flaw to write arbitrary files and execute commands with root privileges on the affected operating system. The vulnerability has been observed in the wild since October 2026, and Cisco has released patches and provided IoCs to help customers detect and remediate potential compromises.","Cisco warns of exploited critical vulnerability in Secure Email Gateway.","https:\u002F\u002Fwww.securityweek.com\u002Fcisco-warns-of-exploited-secure-email-gateway-vulnerability\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002FCisco-network-switch-exploit.webp","2026-10-15T06:34:15+00:00","2026-10-15T08:00:08.799392+00:00",9,[17,20,23,26],{"name":18,"type":19},"Secure Email Gateway","product",{"name":21,"type":22},"Cisco","vendor",{"name":24,"type":25},"Advanced Malware Protection","technology",{"name":27,"type":19},"AsyncOS","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,39,41],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":40},{"id":28,"icon":30,"name":31,"slug":32},{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,51,54],{"type":48,"value":49,"context":50},"cve","CVE-2026-76519","Critical vulnerability in Cisco Secure Email Gateway's AMP feature.",{"type":48,"value":52,"context":53},"CVE-2026-76461","Another unauthenticated bug in Cisco Secure Email Gateway leading to root command execution.",{"type":48,"value":55,"context":56},"CVE-2026-76440","Vulnerability grouped with CVE-2026-76519 in initial Cisco advisory.",[21,18,27],{"controls":59,"vendors":146},[60,89,118],{"slug":61,"name":62,"problem":63,"products":64},"patch-management","Automated patch management","Known holes get closed in days, not months.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":90,"name":91,"problem":92,"products":93},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":45,"name":119,"problem":120,"products":121},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",[147],{"slug":148,"name":21,"logo_path":149,"roles":150},"cisco","\u002Fvendor-logos\u002Fcisco.png",[151,152],"affected","reported_by",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":168},"cisco-secure-email-gateway-flaw-exploited-in-the-wild-patch-immediately","Cisco Secure Email Gateway Flaw Exploited in the Wild — Patch Immediately","A critical vulnerability in Cisco's Secure Email Gateway allowed attackers to write arbitrary files and execute commands with full root privileges, effectively granting complete control over the affected system. The flaw resided in the Advanced Malware Protection feature — an ironic target, as security tooling itself became the attack vector. Active exploitation was observed in the wild before many organizations had applied available patches, highlighting the danger of delayed patch cycles for internet-facing appliances. This incident underscores that network security devices are high-value targets precisely because they sit at the perimeter and often run with elevated privileges. Timely patch application and proactive vulnerability tracking are non-negotiable for critical infrastructure components.",[158,159,160,161,162,163,164,165,166,167],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST SI-7: Software, Firmware, and Information Integrity","NIST RA-5: Vulnerability Monitoring and Scanning","NIST AC-6: Least Privilege","ITIL Change Management: Emergency Change Procedures","ISO\u002FIEC 27001: A.12.6.1 Management of Technical Vulnerabilities",{}]