CISA confirms active exploitation of Cisco Secure Email Gateway flaw
CVE-2026-76519 affects Cisco Secure Email Gateway. CISA added the flaw to the KEV catalog, which indicates active exploitation in the wild. Cisco has released a fix in a security advisory; users of the product should update their gateways as a priority.
What happened
CISA added CVE-2026-76519, affecting Cisco Secure Email Gateway, to the Known Exploited Vulnerabilities (KEV) catalog. The listing indicates attackers are already exploiting the flaw. Cisco has published a fix in a security advisory.
Why it matters
Cisco Secure Email Gateway protects corporate email; a flaw with confirmed active exploitation in this product demands immediate response. Until the fix is applied, the vulnerable version remains exposed to a flaw attackers are already using.
What to do
Immediately update all Cisco Secure Email Gateway devices following the Cisco advisory. Then confirm every gateway received the fix and review logs for signs of exploitation.
For the technical team
- CVE
- CVE-2026-76519
- Affected
- Cisco Secure Email Gateway · Cisco Secure Email Gateway (CVE-2026-76519). Affected versions not listed in the sources; see the Cisco advisory.
- Exploitation
- Active exploitation indicated by the CVE's inclusion in the CISA KEV catalog. The sources do not cite a KEV addition date or reports of specific victims.
- Fix
- Fix released by Cisco; the advisory is marked as patched. Fixed versions not detailed in the sources; see advisory cisco-sa-esa-afw-zqYJkjxp, started 2026-10-14.
- More details
- Cisco advisory: cisco-sa-esa-afw-zqYJkjxp, published 2026-10-14, with severity rated high by Cisco. The CVE has an NVD entry. The CISA KEV catalog is listed as a reference for the case.
Timeline
CISA KEV listing indicates active exploitation of the flaw.
